arm64: expose FAR_EL1 tag bits in siginfo

We currently include signal-defs.h on all architectures except parisc. Make parisc fall in line. This will make maintenance easier once the flag bits are moved here.

Signed-off-by Peter Collingbourne <[email protected]>

---
View this change in Gerrit: https://linux-review.googlesource.com/q/If03a5135fb514fe96548fb74610e6c3586a04064

 arch/parisc/include/uapi/asm/signal.h  | 9 +--------
 include/uapi/asm-generic/signal-defs.h | 6 ++++++
 2 files changed, 7 insertions(+), 8 deletions(-)

arch/parisc/include/uapi/asm/signal.h +1 -8

index d38563a394f2..92a1c7ea44b4 100644
@@ -69,14 +69,7 @@
 #define MINSIGSTKSZ	2048
 #define SIGSTKSZ	8192
 
-
-#define SIG_BLOCK          0	/* for blocking signals */
-#define SIG_UNBLOCK        1	/* for unblocking signals */
-#define SIG_SETMASK        2	/* for setting the signal mask */
-
-#define SIG_DFL	((__sighandler_t)0)	/* default signal handling */
-#define SIG_IGN	((__sighandler_t)1)	/* ignore signal */
-#define SIG_ERR	((__sighandler_t)-1)	/* error return from signal */
+#include <asm/signal-defs.h>
 
 # ifndef __ASSEMBLY__
 

include/uapi/asm-generic/signal-defs.h +0 -0

index e9304c95ceea..ecdf6312bfa5 100644
@@ -15,8 +15,14 @@
 #endif

include/uapi/asm-generic/signal-defs.h +1 -0

+#endif
 
 typedef void __restorefn_t(void);

typedef __restorefn_t __user *__sigrestore_t;

Quoted 3 lines · Peter Collingbourne

We currently include signal-defs.h on all architectures except parisc. Make parisc fall in line. This will make maintenance easier once the flag bits are moved here.

The patch is basically OK, but....

Quoted 34 lines

Signed-off-by Peter Collingbourne <[email protected]>

---
View this change in Gerrit: https://linux-review.googlesource.com/q/If03a5135fb514fe96548fb74610e6c3586a04064

 arch/parisc/include/uapi/asm/signal.h  | 9 +--------
 include/uapi/asm-generic/signal-defs.h | 6 ++++++
 2 files changed, 7 insertions(+), 8 deletions(-)

arch/parisc/include/uapi/asm/signal.h +1 -8

index d38563a394f2..92a1c7ea44b4 100644
@@ -69,14 +69,7 @@
 #define MINSIGSTKSZ  2048
 #define SIGSTKSZ     8192
 
-
-#define SIG_BLOCK          0 /* for blocking signals */
-#define SIG_UNBLOCK        1 /* for unblocking signals */
-#define SIG_SETMASK        2 /* for setting the signal mask */
-
-#define SIG_DFL      ((__sighandler_t)0)     /* default signal handling */
-#define SIG_IGN      ((__sighandler_t)1)     /* ignore signal */
-#define SIG_ERR      ((__sighandler_t)-1)    /* error return from signal */
+#include <asm/signal-defs.h>
 
 # ifndef __ASSEMBLY__
 

include/uapi/asm-generic/signal-defs.h +0 -0

index e9304c95ceea..ecdf6312bfa5 100644
@@ -15,8 +15,14 @@
 #endif

include/uapi/asm-generic/signal-defs.h line 25

Quoted 10 lines

include/uapi/asm-generic/signal-defs.h +5 -0

 
 #ifndef __ASSEMBLY__
 
+#ifndef __hppa__
+/*
+ * These have a special definition on parisc, see:
+ * arch/parisc/include/uapi/asm/signal.h
+ */
 typedef void __signalfn_t(int);
 typedef __signalfn_t __user *__sighandler_t;

please drop this special-case/#ifdef for hppa/parisc.
Instead please drop the typedef in arch/parisc/include/uapi/asm/signal.h, same as you did for the other architectures.

I've committed this patch to my tree, which will collide with yours:
https://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux.git/commit/?h=for-next
If you like I can drop mine, and you fix it up on your side. Just let me know.

Other than that you can add:

Acked-by Helge Deller <[email protected]>

Thanks!

Quoted 65 lines · Helge Deller

Quoted 3 lines · Peter Collingbourne

We currently include signal-defs.h on all architectures except parisc. Make parisc fall in line. This will make maintenance easier once the flag bits are moved here.

The patch is basically OK, but....

Quoted 34 lines

Signed-off-by Peter Collingbourne <[email protected]>

---
View this change in Gerrit: https://linux-review.googlesource.com/q/If03a5135fb514fe96548fb74610e6c3586a04064

 arch/parisc/include/uapi/asm/signal.h  | 9 +--------
 include/uapi/asm-generic/signal-defs.h | 6 ++++++
 2 files changed, 7 insertions(+), 8 deletions(-)

arch/parisc/include/uapi/asm/signal.h +1 -8

index d38563a394f2..92a1c7ea44b4 100644
@@ -69,14 +69,7 @@
 #define MINSIGSTKSZ  2048
 #define SIGSTKSZ     8192
 
-
-#define SIG_BLOCK          0 /* for blocking signals */
-#define SIG_UNBLOCK        1 /* for unblocking signals */
-#define SIG_SETMASK        2 /* for setting the signal mask */
-
-#define SIG_DFL      ((__sighandler_t)0)     /* default signal handling */
-#define SIG_IGN      ((__sighandler_t)1)     /* ignore signal */
-#define SIG_ERR      ((__sighandler_t)-1)    /* error return from signal */
+#include <asm/signal-defs.h>
 
 # ifndef __ASSEMBLY__
 

include/uapi/asm-generic/signal-defs.h +0 -0

index e9304c95ceea..ecdf6312bfa5 100644
@@ -15,8 +15,14 @@
 #endif

include/uapi/asm-generic/signal-defs.h line 25

Quoted 10 lines

include/uapi/asm-generic/signal-defs.h +5 -0

 
 #ifndef __ASSEMBLY__
 
+#ifndef __hppa__
+/*
+ * These have a special definition on parisc, see:
+ * arch/parisc/include/uapi/asm/signal.h
+ */
 typedef void __signalfn_t(int);
 typedef __signalfn_t __user *__sighandler_t;

please drop this special-case/#ifdef for hppa/parisc.
Instead please drop the typedef in arch/parisc/include/uapi/asm/signal.h, same as you did for the other architectures.

I've committed this patch to my tree, which will collide with yours:
https://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux.git/commit/?h=for-next
If you like I can drop mine, and you fix it up on your side. Just let me know.

Other than that you can add:

Acked-by Helge Deller <[email protected]>

Quoted 1 line

Thanks!

Thanks for the review and apologies for the delay in getting back to you. I've picked up your patch from your for-next branch into my series before this change, and removed the special case for hppa. I also build tested my series on hppa which revealed a typo in the #include directive which I fixed. The new patch looks like this and it will be included in v11 which I will try to send out soon.

arch/parisc/include/uapi/asm/signal.h +1 -12

index f1fd4fa880d7..e67b1bfb82ba 100644
@@ -69,14 +69,7 @@
 #define MINSIGSTKSZ    2048
 #define SIGSTKSZ       8192
 
-
-#define SIG_BLOCK          0   /* for blocking signals */
-#define SIG_UNBLOCK        1   /* for unblocking signals */
-#define SIG_SETMASK        2   /* for setting the signal mask */
-
-#define SIG_DFL        ((__sighandler_t)0)     /* default signal handling */
-#define SIG_IGN        ((__sighandler_t)1)     /* ignore signal */
-#define SIG_ERR        ((__sighandler_t)-1)    /* error return from signal */
+#include <asm-generic/signal-defs.h>
 
 # ifndef __ASSEMBLY__
 

@@ -85,10 +78,6 @@
 /* Avoid too many header ordering problems.  */
 struct siginfo;
 
-/* Type of a signal handler.  */
-typedef void __signalfn_t(int);
-typedef __signalfn_t __user *__sighandler_t;
-
 typedef struct sigaltstack {
        void __user *ss_sp;
        int ss_flags;

Peter

We currently include signal-defs.h on all architectures except parisc. Make parisc fall in line. This will make maintenance easier once the flag bits are moved here.

Signed-off-by Peter Collingbourne <[email protected]>

---
View this change in Gerrit: https://linux-review.googlesource.com/q/If03a5135fb514fe96548fb74610e6c3586a04064

 arch/parisc/include/uapi/asm/signal.h  | 9 +--------
 include/uapi/asm-generic/signal-defs.h | 6 ++++++
 2 files changed, 7 insertions(+), 8 deletions(-)

arch/parisc/include/uapi/asm/signal.h +1 -8

index d38563a394f2..92a1c7ea44b4 100644
@@ -69,14 +69,7 @@
 #define MINSIGSTKSZ	2048
 #define SIGSTKSZ	8192
 
-
-#define SIG_BLOCK          0	/* for blocking signals */
-#define SIG_UNBLOCK        1	/* for unblocking signals */
-#define SIG_SETMASK        2	/* for setting the signal mask */
-
-#define SIG_DFL	((__sighandler_t)0)	/* default signal handling */
-#define SIG_IGN	((__sighandler_t)1)	/* ignore signal */
-#define SIG_ERR	((__sighandler_t)-1)	/* error return from signal */
+#include <asm/signal-defs.h>
 
 # ifndef __ASSEMBLY__
 

include/uapi/asm-generic/signal-defs.h +0 -0

index e9304c95ceea..ecdf6312bfa5 100644
@@ -15,8 +15,14 @@
 #endif

Most architectures with the exception of alpha, mips, parisc and sparc use the same values for these flags. Move their definitions into asm-generic/signal-defs.h and allow the architectures with non-standard values to override them. Also, document the non-standard flag values in order to make it easier to add new generic flags in the future.

Signed-off-by Peter Collingbourne <[email protected]>

Quoted 7 lines · Peter Collingbourne

Most architectures with the exception of alpha, mips, parisc and sparc use the same values for these flags. Move their definitions into asm-generic/signal-defs.h and allow the architectures with non-standard values to override them. Also, document the non-standard flag values in order to make it easier to add new generic flags in the future.

Signed-off-by Peter Collingbourne <[email protected]>

While this looks reasonable, I've just realised that you strip the "U" from some arches' definitions here.

So, on powerpc and x86, this changes the type of flags other than SA_RESETHAND from unsigned int to int.

While I can't see this breaking any sensible use of these flags, there's a chance that there is software relying on this distinction by accident.

I wonder whether it's worth doing something like

        #ifdef ARCH_WANT_STRICTLY_UNSIGNED_SA_FLAGS
        #define __SA_FLAG_VAL(x) x ## U
        #else
        #define __SA_FLAG_VAL(x) x
        #endif

        #ifndef SA_NOCLDSTOP
        #define SA_NOCLDSTOP __SA_FLAG_VAL(0x00000001)
        #endif

        /* ... */

Mind you, the historical situation also has issues, e.g. because sa_flags in struct sigaction is an int, assigning

        struct sigaction sa;

        sa.sa_flags = SA_RESETHAND;

implies an overflow and so isn't portably safe (at least in theory). I guess we are getting away with it today. Preserving the situation by keeping the "U"s where appropriate would at least avoid making the situation worse.

Quoted 13 lines · Dave Martin

Quoted 7 lines · Peter Collingbourne

Most architectures with the exception of alpha, mips, parisc and sparc use the same values for these flags. Move their definitions into asm-generic/signal-defs.h and allow the architectures with non-standard values to override them. Also, document the non-standard flag values in order to make it easier to add new generic flags in the future.

Signed-off-by Peter Collingbourne <[email protected]>

While this looks reasonable, I've just realised that you strip the "U" from some arches' definitions here.

Quoted 6 lines

So, on powerpc and x86, this changes the type of flags other than SA_RESETHAND from unsigned int to int.

While I can't see this breaking any sensible use of these flags, there's a chance that there is software relying on this distinction by accident.

While it's true that it's technically possible that making these signed could change semantics, I'm having trouble seeing a realistic way in which software could be relying on this. Can you see one? I can think of cases like if the code does something like left shifts one of the flag bits into the sign bit (technically undefined behavior) and then right shifts it back (in C this would need to all be done in a single expression without storing to a variable; in C++ I suppose you could use auto to preserve the signedness in a variable's type). For example:

int x = (SA_NODEFER << 1) >> 1;

would give a different value to x if we made SA_NODEFER signed. But I wouldn't really expect software to be doing this sort of thing even accidentally, or much more than or'ing the flags together and assigning them to a variable, or passing them as a parameter, or some other operation which would fix the type.

I believe that the kernel's uapi guarantee applies at the binary level, not at the source level. If that were not the case, I think we would not be allowed to add any new declaration to an existing .h file for fear of conflicting with a user program's identically spelled declaration. And that seems more likely to me than software that would do this sort of thing.

Quoted 13 lines

I wonder whether it's worth doing something like

        #ifdef ARCH_WANT_STRICTLY_UNSIGNED_SA_FLAGS
        #define __SA_FLAG_VAL(x) x ## U
        #else
        #define __SA_FLAG_VAL(x) x
        #endif

        #ifndef SA_NOCLDSTOP
        #define SA_NOCLDSTOP __SA_FLAG_VAL(0x00000001)
        #endif

        /* ... */

If we do this I would mildly prefer to keep the existing #defines in the arch-specific headers as if the arch had different flag values, as this would leave the arch-specific legacy cruft in the arch-specific headers where it belongs.

Quoted 11 lines

Mind you, the historical situation also has issues, e.g. because sa_flags in struct sigaction is an int, assigning

        struct sigaction sa;

        sa.sa_flags = SA_RESETHAND;

implies an overflow and so isn't portably safe (at least in theory). I guess we are getting away with it today. Preserving the situation by keeping the "U"s where appropriate would at least avoid making the situation worse.

I believe that the result of this assignment (involving an unsigned to signed conversion) is implementation defined and not undefined (which would be problematic). And in all the implementations that matter, as well as the C++ standard starting with C++20, this is a no-op cast assuming two's complement. I'm not sure what this has to do with making the constants signed because, as you pointed out, SA_RESETHAND would remain unsigned despite the absence of 'U' because its value does not fit in an int.

Previously we were not clearing non-uapi flag bits in sigaction.sa_flags when storing the userspace-provided sa_flags or when returning them via oldact. Start doing so.

This allows userspace to detect missing support for flag bits and allows the kernel to use non-uapi bits internally, as we are already doing in arch/x86 for two flag bits. Now that this change is in place, we no longer need the code in arch/x86 that was hiding these bits from userspace, so remove it.

This is technically a userspace-visible behavior change for sigaction, as the unknown bits returned via oldact.sa_flags are no longer set. However, we are free to define the behavior for unknown bits exactly because their behavior is currently undefined, so for now we can define the meaning of each of them to be "clear the bit in oldact.sa_flags unless the bit becomes known in the future". Furthermore, this behavior is consistent with OpenBSD [1], illumos [2] and XNU [3] (FreeBSD [4] and NetBSD [5] fail the syscall if unknown bits are set). So there is some precedent for this behavior in other kernels, and in particular in XNU, which is probably the most popular kernel among those that I looked at, which means that this change is less likely to be a compatibility issue.

Link [1] https://github.com/openbsd/src/blob/f634a6a4b5bf832e9c1de77f7894ae2625e74484/sys/kern/kern_sig.c#L278

Link [2] https://github.com/illumos/illumos-gate/blob/76f19f5fdc974fe5be5c82a556e43a4df93f1de1/usr/src/uts/common/syscall/sigaction.c#L86

Link [3] https://github.com/apple/darwin-xnu/blob/a449c6a3b8014d9406c2ddbdc81795da24aa7443/bsd/kern/kern_sig.c#L480

Link [4] https://github.com/freebsd/freebsd/blob/eded70c37057857c6e23fae51f86b8f8f43cd2d0/sys/kern/kern_sig.c#L699

Link [5] https://github.com/NetBSD/src/blob/3365779becdcedfca206091a645a0e8e22b2946e/sys/kern/sys_sig.c#L473

Signed-off-by Peter Collingbourne <[email protected]>

---
View this change in Gerrit: https://linux-review.googlesource.com/q/I35aab6f5be932505d90f3b3450c083b4db1eca86

v10:
- rename SA_UAPI_FLAGS -> UAPI_SA_FLAGS
- refactor how we define it to avoid mentioning flags more than once

 arch/arm/include/asm/signal.h    |  2 ++
 arch/parisc/include/asm/signal.h |  2 ++
 arch/x86/kernel/signal_compat.c  |  7 -------
 include/linux/signal_types.h     | 12 ++++++++++++
 kernel/signal.c                  | 10 ++++++++++
 5 files changed, 26 insertions(+), 7 deletions(-)

arch/arm/include/asm/signal.h +2 -0

index 65530a042009..430be7774402 100644
@@ -17,6 +17,8 @@ typedef struct {
 	unsigned long sig[_NSIG_WORDS];
 } sigset_t;
 
+#define __ARCH_UAPI_SA_FLAGS	(SA_THIRTYTWO | SA_RESTORER)
+
 #define __ARCH_HAS_SA_RESTORER
 
 #include <asm/sigcontext.h>

arch/parisc/include/asm/signal.h +2 -0

index 715c96ba2ec8..30dd1e43ef88 100644
@@ -21,6 +21,8 @@ typedef struct {
 	unsigned long sig[_NSIG_WORDS];
 } sigset_t;
 
+#define __ARCH_UAPI_SA_FLAGS	_SA_SIGGFAULT
+
 #include <asm/sigcontext.h>
 
 #endif /* !__ASSEMBLY */

arch/x86/kernel/signal_compat.c +0 -7

index 9ccbf0576cd0..c599013ae8cb 100644
@@ -165,16 +165,9 @@ void sigaction_compat_abi(struct k_sigaction *act, struct k_sigaction *oact)
 {
 	signal_compat_build_tests();
 
-	/* Don't leak in-kernel non-uapi flags to user-space */
-	if (oact)
-		oact->sa.sa_flags &= ~(SA_IA32_ABI | SA_X32_ABI);
-
 	if (!act)
 		return;
 
-	/* Don't let flags to be set from userspace */
-	act->sa.sa_flags &= ~(SA_IA32_ABI | SA_X32_ABI);
-
 	if (in_ia32_syscall())
 		act->sa.sa_flags |= SA_IA32_ABI;
 	if (in_x32_syscall())

include/linux/signal_types.h +2 -0

index f8a90ae9c6ec..a7887ad84d36 100644
@@ -68,4 +68,16 @@ struct ksignal {
 	int sig;
 };
 
+#ifndef __ARCH_UAPI_SA_FLAGS
+#ifdef SA_RESTORER

include/linux/signal_types.h +0 -0

 #endif /* _LINUX_SIGNAL_TYPES_H */

kernel/signal.c +0 -0

index 42b67d2cea37..f802c82c7bcc 100644
@@ -3984,6 +3984,16 @@ int do_sigaction(int sig, struct k_sigaction *act, struct k_sigaction *oact)
 	if (oact)
 		*oact = *k;
 

Quoted 98 lines · Peter Collingbourne

Previously we were not clearing non-uapi flag bits in sigaction.sa_flags when storing the userspace-provided sa_flags or when returning them via oldact. Start doing so.

This allows userspace to detect missing support for flag bits and allows the kernel to use non-uapi bits internally, as we are already doing in arch/x86 for two flag bits. Now that this change is in place, we no longer need the code in arch/x86 that was hiding these bits from userspace, so remove it.

This is technically a userspace-visible behavior change for sigaction, as the unknown bits returned via oldact.sa_flags are no longer set. However, we are free to define the behavior for unknown bits exactly because their behavior is currently undefined, so for now we can define the meaning of each of them to be "clear the bit in oldact.sa_flags unless the bit becomes known in the future". Furthermore, this behavior is consistent with OpenBSD [1], illumos [2] and XNU [3] (FreeBSD [4] and NetBSD [5] fail the syscall if unknown bits are set). So there is some precedent for this behavior in other kernels, and in particular in XNU, which is probably the most popular kernel among those that I looked at, which means that this change is less likely to be a compatibility issue.

Link [1] https://github.com/openbsd/src/blob/f634a6a4b5bf832e9c1de77f7894ae2625e74484/sys/kern/kern_sig.c#L278

Link [2] https://github.com/illumos/illumos-gate/blob/76f19f5fdc974fe5be5c82a556e43a4df93f1de1/usr/src/uts/common/syscall/sigaction.c#L86

Link [3] https://github.com/apple/darwin-xnu/blob/a449c6a3b8014d9406c2ddbdc81795da24aa7443/bsd/kern/kern_sig.c#L480

Link [4] https://github.com/freebsd/freebsd/blob/eded70c37057857c6e23fae51f86b8f8f43cd2d0/sys/kern/kern_sig.c#L699

Link [5] https://github.com/NetBSD/src/blob/3365779becdcedfca206091a645a0e8e22b2946e/sys/kern/sys_sig.c#L473

Signed-off-by Peter Collingbourne <[email protected]>

---
View this change in Gerrit: https://linux-review.googlesource.com/q/I35aab6f5be932505d90f3b3450c083b4db1eca86

v10:
- rename SA_UAPI_FLAGS -> UAPI_SA_FLAGS
- refactor how we define it to avoid mentioning flags more than once

 arch/arm/include/asm/signal.h    |  2 ++
 arch/parisc/include/asm/signal.h |  2 ++
 arch/x86/kernel/signal_compat.c  |  7 -------
 include/linux/signal_types.h     | 12 ++++++++++++
 kernel/signal.c                  | 10 ++++++++++
 5 files changed, 26 insertions(+), 7 deletions(-)

arch/arm/include/asm/signal.h +2 -0

index 65530a042009..430be7774402 100644
@@ -17,6 +17,8 @@ typedef struct {
      unsigned long sig[_NSIG_WORDS];
 } sigset_t;
 
+#define __ARCH_UAPI_SA_FLAGS (SA_THIRTYTWO | SA_RESTORER)
+
 #define __ARCH_HAS_SA_RESTORER
 
 #include <asm/sigcontext.h>

arch/parisc/include/asm/signal.h +2 -0

index 715c96ba2ec8..30dd1e43ef88 100644
@@ -21,6 +21,8 @@ typedef struct {
      unsigned long sig[_NSIG_WORDS];
 } sigset_t;
 
+#define __ARCH_UAPI_SA_FLAGS _SA_SIGGFAULT
+
 #include <asm/sigcontext.h>
 
 #endif /* !__ASSEMBLY */

arch/x86/kernel/signal_compat.c +0 -7

index 9ccbf0576cd0..c599013ae8cb 100644
@@ -165,16 +165,9 @@ void sigaction_compat_abi(struct k_sigaction *act, struct k_sigaction *oact)
 {
      signal_compat_build_tests();
 
-     /* Don't leak in-kernel non-uapi flags to user-space */
-     if (oact)
-             oact->sa.sa_flags &= ~(SA_IA32_ABI | SA_X32_ABI);
-
      if (!act)
              return;
 
-     /* Don't let flags to be set from userspace */
-     act->sa.sa_flags &= ~(SA_IA32_ABI | SA_X32_ABI);
-
      if (in_ia32_syscall())
              act->sa.sa_flags |= SA_IA32_ABI;
      if (in_x32_syscall())

include/linux/signal_types.h +0 -0

index f8a90ae9c6ec..a7887ad84d36 100644
@@ -68,4 +68,16 @@ struct ksignal {
      int sig;
 };
 

include/linux/signal_types.h struct ksignal { · line 82

Quoted 12 lines

include/linux/signal_types.h +12 -0

+#ifndef __ARCH_UAPI_SA_FLAGS
+#ifdef SA_RESTORER
+#define __ARCH_UAPI_SA_FLAGS SA_RESTORER
+#else
+#define __ARCH_UAPI_SA_FLAGS 0
+#endif
+#endif
+
+#define UAPI_SA_FLAGS                                                          \
+     (SA_NOCLDSTOP | SA_NOCLDWAIT | SA_SIGINFO | SA_ONSTACK | SA_RESTART |  \
+      SA_NODEFER | SA_RESETHAND | __ARCH_UAPI_SA_FLAGS)
+

Part of me wants this to be closer to the common flag definitions. But we don't really want to define this in the UAPI headers.

Unless you can think of another good place to put it, this is probably OK as-is.

This bit will never be supported in the uapi. The purpose of this flag bit is to allow userspace to distinguish an old kernel that does not clear unknown sa_flags bits from a kernel that supports every flag bit.

In other words, if userspace finds that this bit remains set in oldact.sa_flags, it means that the kernel cannot be trusted to have cleared unknown flag bits from sa_flags, so no assumptions about flag bit support can be made.

Signed-off-by Peter Collingbourne <[email protected]>

---
View this change in Gerrit: https://linux-review.googlesource.com/q/Ic2501ad150a3a79c1cf27fb8c99be342e9dffbcb

 include/uapi/asm-generic/signal-defs.h | 7 +++++++
 kernel/signal.c                        | 6 ++++++
 2 files changed, 13 insertions(+)

include/uapi/asm-generic/signal-defs.h +6 -0

index 319628058a53..e853cbe8722d 100644
@@ -14,6 +14,12 @@
  * SA_RESTART flag to get restarting signals (which were the default long ago)
  * SA_NODEFER prevents the current signal from being masked in the handler.
  * SA_RESETHAND clears the handler when the signal is delivered.
+ * SA_UNSUPPORTED is a flag bit that will never be supported. Kernels from
+ * before the introduction of SA_UNSUPPORTED did not clear unknown bits from
+ * sa_flags when read using the oldact argument to sigaction and rt_sigaction,
+ * so this bit allows flag bit support to be detected from userspace while
+ * allowing an old kernel to be distinguished from a kernel that supports every
+ * flag bit.
  *
  * SA_ONESHOT and SA_NOMASK are the historical Linux names for the Single
  * Unix names RESETHAND and NODEFER respectively.

include/uapi/asm-generic/signal-defs.h +0 -0

 #define SA_NOMASK	SA_NODEFER
 #define SA_ONESHOT	SA_RESETHAND

kernel/signal.c +0 -0

index f802c82c7bcc..c80e70bde11d 100644

On Fri, Aug 21, 2020 at 10:10:14PM -0700, Peter Collingbourne wrote:

Nit: no statement of the chage being made (other than in the subject line).

Quoted 8 lines

This bit will never be supported in the uapi. The purpose of this flag bit is to allow userspace to distinguish an old kernel that does not clear unknown sa_flags bits from a kernel that supports every flag bit.

In other words, if userspace finds that this bit remains set in oldact.sa_flags, it means that the kernel cannot be trusted to have cleared unknown flag bits from sa_flags, so no assumptions about flag bit support can be made.

This isn't quite right? After a single sigaction() call, oact will contain the sa_flags for the previously registered handler. So a second sigaction() call would be needed to find out the newly effective sa_flags.

Quoted 27 lines

Signed-off-by Peter Collingbourne <[email protected]>

---
View this change in Gerrit: https://linux-review.googlesource.com/q/Ic2501ad150a3a79c1cf27fb8c99be342e9dffbcb

 include/uapi/asm-generic/signal-defs.h | 7 +++++++
 kernel/signal.c                        | 6 ++++++
 2 files changed, 13 insertions(+)

include/uapi/asm-generic/signal-defs.h +6 -0

index 319628058a53..e853cbe8722d 100644
@@ -14,6 +14,12 @@
  * SA_RESTART flag to get restarting signals (which were the default long ago)
  * SA_NODEFER prevents the current signal from being masked in the handler.
  * SA_RESETHAND clears the handler when the signal is delivered.
+ * SA_UNSUPPORTED is a flag bit that will never be supported. Kernels from
+ * before the introduction of SA_UNSUPPORTED did not clear unknown bits from
+ * sa_flags when read using the oldact argument to sigaction and rt_sigaction,
+ * so this bit allows flag bit support to be detected from userspace while
+ * allowing an old kernel to be distinguished from a kernel that supports every
+ * flag bit.
  *
  * SA_ONESHOT and SA_NOMASK are the historical Linux names for the Single
  * Unix names RESETHAND and NODEFER respectively.

include/uapi/asm-generic/signal-defs.h line 51

Quoted 4 lines

include/uapi/asm-generic/signal-defs.h +1 -0

@@ -42,6 +48,7 @@
 #ifndef SA_RESETHAND
 #define SA_RESETHAND 0x80000000
 #endif
+#define SA_UNSUPPORTED       0x00000400

I guess people may debate which bit is chosen, but your consolidation of these definitions should help to reduce the possibility of future collisions. This bit appears unused for now, so I guess I don't have a strong opinion.

Quoted 7 lines

include/uapi/asm-generic/signal-defs.h +0 -0

 #define SA_NOMASK    SA_NODEFER
 #define SA_ONESHOT   SA_RESETHAND

kernel/signal.c +0 -0

index f802c82c7bcc..c80e70bde11d 100644

kernel/signal.c int do_sigaction(int sig, struct k_sigaction *act, struct k_sigaction *oact) · line 3992

Quoted 9 lines

kernel/signal.c +6 -0

@@ -3984,6 +3984,12 @@ int do_sigaction(int sig, struct k_sigaction *act, struct k_sigaction *oact)
      if (oact)
              *oact = *k;
 
+     /*
+      * Make sure that we never accidentally claim to support SA_UNSUPPORTED,
+      * e.g. by having an architecture use the bit in their uapi.
+      */
+     BUILD_BUG_ON(UAPI_SA_FLAGS & SA_UNSUPPORTED);
+

Seems reasonable.

With the above rewording in the commit message to clarify that a second sigaction() is needed:

Reviewed-by Dave Martin <[email protected]>

Quoted 5 lines · Dave Martin

On Fri, Aug 21, 2020 at 10:10:14PM -0700, Peter Collingbourne wrote:

Nit: no statement of the chage being made (other than in the subject line).

Will fix.

Quoted 9 lines

Quoted 8 lines

This bit will never be supported in the uapi. The purpose of this flag bit is to allow userspace to distinguish an old kernel that does not clear unknown sa_flags bits from a kernel that supports every flag bit.

In other words, if userspace finds that this bit remains set in oldact.sa_flags, it means that the kernel cannot be trusted to have cleared unknown flag bits from sa_flags, so no assumptions about flag bit support can be made.

Quoted 4 lines

This isn't quite right? After a single sigaction() call, oact will contain the sa_flags for the previously registered handler. So a second sigaction() call would be needed to find out the newly effective sa_flags.

You're right, this is unclear to say the least. In v11 I will reword like so:

In other words, if userspace does something like:

act.sa_flags |= SA_UNSUPPORTED;
sigaction(SIGSEGV, &act, 0);
sigaction(SIGSEGV, 0, &oldact);

and finds that SA_UNSUPPORTED remains set in oldact.sa_flags, it means that the kernel cannot be trusted to have cleared unknown flag bits from sa_flags, so no assumptions about flag bit support can be made.

We're about to add more common _sigfault fields, so deduplicate the existing code for initializing _sigfault fields in {send,force}_sig_*, and for copying _sigfault fields in copy_siginfo_to_external32 and post_copy_siginfo_from_user32, to reduce the number of places that will need to be updated by upcoming changes.

Signed-off-by Peter Collingbourne <[email protected]>

---
View this change in Gerrit: https://linux-review.googlesource.com/q/I4f56174e1b7b2bf4a3c8139e6879cbfd52750a24

 include/linux/signal.h |  13 ++++++
 kernel/signal.c        | 101 ++++++++++++++++-------------------------
 2 files changed, 53 insertions(+), 61 deletions(-)

include/linux/signal.h +13 -0

index 6bb1a3f0258c..3edbf54493ee 100644
@@ -50,6 +50,19 @@ enum siginfo_layout {
 
 enum siginfo_layout siginfo_layout(unsigned sig, int si_code);
 
+static inline bool siginfo_layout_is_fault(enum siginfo_layout layout)
+{
+	switch (layout) {
+	case SIL_FAULT:
+	case SIL_FAULT_MCEERR:
+	case SIL_FAULT_BNDERR:
+	case SIL_FAULT_PKUERR:
+		return true;
+	default:
+		return false;
+	}
+}
+
 /*
  * Define some primitives to manipulate sigset_t.
  */

kernel/signal.c +19 -27

index c80e70bde11d..4ee9dc03f20f 100644
@@ -1649,6 +1649,15 @@ void force_sigsegv(int sig)
 	force_sig(SIGSEGV);
 }
 
+static void set_sigfault_common_fields(struct kernel_siginfo *info, int sig,
+				       int code, void __user *addr)
+{
+	info->si_signo = sig;
+	info->si_errno = 0;
+	info->si_code = code;
+	info->si_addr = addr;
+}
+
 int force_sig_fault_to_task(int sig, int code, void __user *addr
 	___ARCH_SI_TRAPNO(int trapno)
 	___ARCH_SI_IA64(int imm, unsigned int flags, unsigned long isr)

@@ -1657,10 +1666,7 @@ int force_sig_fault_to_task(int sig, int code, void __user *addr
 	struct kernel_siginfo info;
 
 	clear_siginfo(&info);
-	info.si_signo = sig;
-	info.si_errno = 0;
-	info.si_code  = code;
-	info.si_addr  = addr;
+	set_sigfault_common_fields(&info, sig, code, addr);
 #ifdef __ARCH_SI_TRAPNO
 	info.si_trapno = trapno;
 #endif

@@ -1689,10 +1695,7 @@ int send_sig_fault(int sig, int code, void __user *addr
 	struct kernel_siginfo info;
 
 	clear_siginfo(&info);
-	info.si_signo = sig;
-	info.si_errno = 0;
-	info.si_code  = code;
-	info.si_addr  = addr;
+	set_sigfault_common_fields(&info, sig, code, addr);
 #ifdef __ARCH_SI_TRAPNO
 	info.si_trapno = trapno;
 #endif

@@ -1710,10 +1713,7 @@ int force_sig_mceerr(int code, void __user *addr, short lsb)
 
 	WARN_ON((code != BUS_MCEERR_AO) && (code != BUS_MCEERR_AR));
 	clear_siginfo(&info);
-	info.si_signo = SIGBUS;
-	info.si_errno = 0;
-	info.si_code = code;
-	info.si_addr = addr;
+	set_sigfault_common_fields(&info, SIGBUS, code, addr);
 	info.si_addr_lsb = lsb;
 	return force_sig_info(&info);
 }

@@ -1724,10 +1724,7 @@ int send_sig_mceerr(int code, void __user *addr, short lsb, struct task_struct *
 
 	WARN_ON((code != BUS_MCEERR_AO) && (code != BUS_MCEERR_AR));
 	clear_siginfo(&info);
-	info.si_signo = SIGBUS;
-	info.si_errno = 0;
-	info.si_code = code;
-	info.si_addr = addr;
+	set_sigfault_common_fields(&info, SIGBUS, code, addr);
 	info.si_addr_lsb = lsb;
 	return send_sig_info(info.si_signo, &info, t);
 }

@@ -1738,10 +1735,7 @@ int force_sig_bnderr(void __user *addr, void __user *lower, void __user *upper)
 	struct kernel_siginfo info;
 
 	clear_siginfo(&info);
-	info.si_signo = SIGSEGV;
-	info.si_errno = 0;
-	info.si_code  = SEGV_BNDERR;
-	info.si_addr  = addr;
+	set_sigfault_common_fields(&info, SIGSEGV, SEGV_BNDERR, addr);
 	info.si_lower = lower;
 	info.si_upper = upper;
 	return force_sig_info(&info);

@@ -1753,10 +1747,7 @@ int force_sig_pkuerr(void __user *addr, u32 pkey)
 	struct kernel_siginfo info;
 
 	clear_siginfo(&info);
-	info.si_signo = SIGSEGV;
-	info.si_errno = 0;
-	info.si_code  = SEGV_PKUERR;
-	info.si_addr  = addr;
+	set_sigfault_common_fields(&info, SIGSEGV, SEGV_PKUERR, addr);
 	info.si_pkey  = pkey;
 	return force_sig_info(&info);
 }

@@ -1770,10 +1761,8 @@ int force_sig_ptrace_errno_trap(int errno, void __user *addr)
 	struct kernel_siginfo info;
 
 	clear_siginfo(&info);
-	info.si_signo = SIGTRAP;
+	set_sigfault_common_fields(&info, SIGTRAP, TRAP_HWBKPT, addr);
 	info.si_errno = errno;
-	info.si_code  = TRAP_HWBKPT;
-	info.si_addr  = addr;
 	return force_sig_info(&info);
 }
 

@@ -3266,12 +3255,23 @@ int copy_siginfo_from_user(kernel_siginfo_t *to, const siginfo_t __user *from)
 void copy_siginfo_to_external32(struct compat_siginfo *to,
 		const struct kernel_siginfo *from)
 {
+	enum siginfo_layout layout =
+		siginfo_layout(from->si_signo, from->si_code);
+
 	memset(to, 0, sizeof(*to));
 
 	to->si_signo = from->si_signo;
 	to->si_errno = from->si_errno;
 	to->si_code  = from->si_code;

kernel/signal.c +3 -16

 	case SIL_KILL:
 		to->si_pid = from->si_pid;
 		to->si_uid = from->si_uid;

@@ -3286,31 +3286,15 @@ void copy_siginfo_to_external32(struct compat_siginfo *to,
 		to->si_fd   = from->si_fd;
 		break;
 	case SIL_FAULT:
-		to->si_addr = ptr_to_compat(from->si_addr);
-#ifdef __ARCH_SI_TRAPNO
-		to->si_trapno = from->si_trapno;
-#endif
 		break;
 	case SIL_FAULT_MCEERR:
-		to->si_addr = ptr_to_compat(from->si_addr);
-#ifdef __ARCH_SI_TRAPNO
-		to->si_trapno = from->si_trapno;
-#endif
 		to->si_addr_lsb = from->si_addr_lsb;
 		break;
 	case SIL_FAULT_BNDERR:
-		to->si_addr = ptr_to_compat(from->si_addr);
-#ifdef __ARCH_SI_TRAPNO
-		to->si_trapno = from->si_trapno;
-#endif
 		to->si_lower = ptr_to_compat(from->si_lower);
 		to->si_upper = ptr_to_compat(from->si_upper);
 		break;
 	case SIL_FAULT_PKUERR:
-		to->si_addr = ptr_to_compat(from->si_addr);
-#ifdef __ARCH_SI_TRAPNO
-		to->si_trapno = from->si_trapno;
-#endif
 		to->si_pkey = from->si_pkey;
 		break;
 	case SIL_CHLD:

@@ -3347,11 +3331,22 @@ int __copy_siginfo_to_user32(struct compat_siginfo __user *to,
 static int post_copy_siginfo_from_user32(kernel_siginfo_t *to,
 					 const struct compat_siginfo *from)
 {
+	enum siginfo_layout layout =
+		siginfo_layout(from->si_signo, from->si_code);
+
 	clear_siginfo(to);
 	to->si_signo = from->si_signo;
 	to->si_errno = from->si_errno;
 	to->si_code  = from->si_code;

Quoted 154 lines · Peter Collingbourne

We're about to add more common _sigfault fields, so deduplicate the existing code for initializing _sigfault fields in {send,force}_sig_*, and for copying _sigfault fields in copy_siginfo_to_external32 and post_copy_siginfo_from_user32, to reduce the number of places that will need to be updated by upcoming changes.

Signed-off-by Peter Collingbourne <[email protected]>

---
View this change in Gerrit: https://linux-review.googlesource.com/q/I4f56174e1b7b2bf4a3c8139e6879cbfd52750a24

 include/linux/signal.h |  13 ++++++
 kernel/signal.c        | 101 ++++++++++++++++-------------------------
 2 files changed, 53 insertions(+), 61 deletions(-)

include/linux/signal.h +13 -0

index 6bb1a3f0258c..3edbf54493ee 100644
@@ -50,6 +50,19 @@ enum siginfo_layout {
 
 enum siginfo_layout siginfo_layout(unsigned sig, int si_code);
 
+static inline bool siginfo_layout_is_fault(enum siginfo_layout layout)
+{
+     switch (layout) {
+     case SIL_FAULT:
+     case SIL_FAULT_MCEERR:
+     case SIL_FAULT_BNDERR:
+     case SIL_FAULT_PKUERR:
+             return true;
+     default:
+             return false;
+     }
+}
+
 /*
  * Define some primitives to manipulate sigset_t.
  */

kernel/signal.c +19 -27

index c80e70bde11d..4ee9dc03f20f 100644
@@ -1649,6 +1649,15 @@ void force_sigsegv(int sig)
      force_sig(SIGSEGV);
 }
 
+static void set_sigfault_common_fields(struct kernel_siginfo *info, int sig,
+                                    int code, void __user *addr)
+{
+     info->si_signo = sig;
+     info->si_errno = 0;
+     info->si_code = code;
+     info->si_addr = addr;
+}
+
 int force_sig_fault_to_task(int sig, int code, void __user *addr
      ___ARCH_SI_TRAPNO(int trapno)
      ___ARCH_SI_IA64(int imm, unsigned int flags, unsigned long isr)

@@ -1657,10 +1666,7 @@ int force_sig_fault_to_task(int sig, int code, void __user *addr
      struct kernel_siginfo info;
 
      clear_siginfo(&info);
-     info.si_signo = sig;
-     info.si_errno = 0;
-     info.si_code  = code;
-     info.si_addr  = addr;
+     set_sigfault_common_fields(&info, sig, code, addr);
 #ifdef __ARCH_SI_TRAPNO
      info.si_trapno = trapno;
 #endif

@@ -1689,10 +1695,7 @@ int send_sig_fault(int sig, int code, void __user *addr
      struct kernel_siginfo info;
 
      clear_siginfo(&info);
-     info.si_signo = sig;
-     info.si_errno = 0;
-     info.si_code  = code;
-     info.si_addr  = addr;
+     set_sigfault_common_fields(&info, sig, code, addr);
 #ifdef __ARCH_SI_TRAPNO
      info.si_trapno = trapno;
 #endif

@@ -1710,10 +1713,7 @@ int force_sig_mceerr(int code, void __user *addr, short lsb)
 
      WARN_ON((code != BUS_MCEERR_AO) && (code != BUS_MCEERR_AR));
      clear_siginfo(&info);
-     info.si_signo = SIGBUS;
-     info.si_errno = 0;
-     info.si_code = code;
-     info.si_addr = addr;
+     set_sigfault_common_fields(&info, SIGBUS, code, addr);
      info.si_addr_lsb = lsb;
      return force_sig_info(&info);
 }

@@ -1724,10 +1724,7 @@ int send_sig_mceerr(int code, void __user *addr, short lsb, struct task_struct *
 
      WARN_ON((code != BUS_MCEERR_AO) && (code != BUS_MCEERR_AR));
      clear_siginfo(&info);
-     info.si_signo = SIGBUS;
-     info.si_errno = 0;
-     info.si_code = code;
-     info.si_addr = addr;
+     set_sigfault_common_fields(&info, SIGBUS, code, addr);
      info.si_addr_lsb = lsb;
      return send_sig_info(info.si_signo, &info, t);
 }

@@ -1738,10 +1735,7 @@ int force_sig_bnderr(void __user *addr, void __user *lower, void __user *upper)
      struct kernel_siginfo info;
 
      clear_siginfo(&info);
-     info.si_signo = SIGSEGV;
-     info.si_errno = 0;
-     info.si_code  = SEGV_BNDERR;
-     info.si_addr  = addr;
+     set_sigfault_common_fields(&info, SIGSEGV, SEGV_BNDERR, addr);
      info.si_lower = lower;
      info.si_upper = upper;
      return force_sig_info(&info);

@@ -1753,10 +1747,7 @@ int force_sig_pkuerr(void __user *addr, u32 pkey)
      struct kernel_siginfo info;
 
      clear_siginfo(&info);
-     info.si_signo = SIGSEGV;
-     info.si_errno = 0;
-     info.si_code  = SEGV_PKUERR;
-     info.si_addr  = addr;
+     set_sigfault_common_fields(&info, SIGSEGV, SEGV_PKUERR, addr);
      info.si_pkey  = pkey;
      return force_sig_info(&info);
 }

@@ -1770,10 +1761,8 @@ int force_sig_ptrace_errno_trap(int errno, void __user *addr)
      struct kernel_siginfo info;
 
      clear_siginfo(&info);
-     info.si_signo = SIGTRAP;
+     set_sigfault_common_fields(&info, SIGTRAP, TRAP_HWBKPT, addr);
      info.si_errno = errno;
-     info.si_code  = TRAP_HWBKPT;
-     info.si_addr  = addr;
      return force_sig_info(&info);
 }
 

@@ -3266,12 +3255,23 @@ int copy_siginfo_from_user(kernel_siginfo_t *to, const siginfo_t __user *from)
 void copy_siginfo_to_external32(struct compat_siginfo *to,
              const struct kernel_siginfo *from)
 {
+     enum siginfo_layout layout =
+             siginfo_layout(from->si_signo, from->si_code);
+
      memset(to, 0, sizeof(*to));
 
      to->si_signo = from->si_signo;
      to->si_errno = from->si_errno;
      to->si_code  = from->si_code;

kernel/signal.c int copy_siginfo_from_user(kernel_siginfo_t *to, const siginfo_t __user *from) · line 3274

Quoted 10 lines

kernel/signal.c +9 -1

-     switch(siginfo_layout(from->si_signo, from->si_code)) {
+
+     if (siginfo_layout_is_fault(layout)) {
+             to->si_addr = ptr_to_compat(from->si_addr);
+#ifdef __ARCH_SI_TRAPNO
+             to->si_trapno = from->si_trapno;
+#endif
+     }
+
+     switch (layout) {

I find the code flow slightly awkward with this change, because the fault signal fields are populated partly in the if() above and partly in the switch(). Previously, only the universal stuff was done outside.

Would this be easier on future maintainers if we pulled the common stuff out into a helper and then called it from the appropriate switch cases? The compiler will probably output some duplicated code in that case (depending on how clever it is at undoing the duplication), but the amount of affected code is small.

Quoted 46 lines

kernel/signal.c +3 -16

      case SIL_KILL:
              to->si_pid = from->si_pid;
              to->si_uid = from->si_uid;

@@ -3286,31 +3286,15 @@ void copy_siginfo_to_external32(struct compat_siginfo *to,
              to->si_fd   = from->si_fd;
              break;
      case SIL_FAULT:
-             to->si_addr = ptr_to_compat(from->si_addr);
-#ifdef __ARCH_SI_TRAPNO
-             to->si_trapno = from->si_trapno;
-#endif
              break;
      case SIL_FAULT_MCEERR:
-             to->si_addr = ptr_to_compat(from->si_addr);
-#ifdef __ARCH_SI_TRAPNO
-             to->si_trapno = from->si_trapno;
-#endif
              to->si_addr_lsb = from->si_addr_lsb;
              break;
      case SIL_FAULT_BNDERR:
-             to->si_addr = ptr_to_compat(from->si_addr);
-#ifdef __ARCH_SI_TRAPNO
-             to->si_trapno = from->si_trapno;
-#endif
              to->si_lower = ptr_to_compat(from->si_lower);
              to->si_upper = ptr_to_compat(from->si_upper);
              break;
      case SIL_FAULT_PKUERR:
-             to->si_addr = ptr_to_compat(from->si_addr);
-#ifdef __ARCH_SI_TRAPNO
-             to->si_trapno = from->si_trapno;
-#endif
              to->si_pkey = from->si_pkey;
              break;
      case SIL_CHLD:

@@ -3347,11 +3331,22 @@ int __copy_siginfo_to_user32(struct compat_siginfo __user *to,
 static int post_copy_siginfo_from_user32(kernel_siginfo_t *to,
                                       const struct compat_siginfo *from)
 {
+     enum siginfo_layout layout =
+             siginfo_layout(from->si_signo, from->si_code);
+
      clear_siginfo(to);
      to->si_signo = from->si_signo;
      to->si_errno = from->si_errno;
      to->si_code  = from->si_code;

kernel/signal.c int __copy_siginfo_to_user32(struct compat_siginfo __user *to, · line 3349

Quoted 10 lines

kernel/signal.c +9 -1

-     switch(siginfo_layout(from->si_signo, from->si_code)) {
+
+     if (siginfo_layout_is_fault(layout)) {
+             to->si_addr = compat_ptr(from->si_addr);
+#ifdef __ARCH_SI_TRAPNO
+             to->si_trapno = from->si_trapno;
+#endif
+     }
+
+     switch (layout) {

Same comment as for copy_siginfo_to_external32()?

[...]

Otherwise, looks reasonable.

Cheers
---Dave

Quoted 171 lines · Dave Martin

Quoted 154 lines · Peter Collingbourne

We're about to add more common _sigfault fields, so deduplicate the existing code for initializing _sigfault fields in {send,force}_sig_*, and for copying _sigfault fields in copy_siginfo_to_external32 and post_copy_siginfo_from_user32, to reduce the number of places that will need to be updated by upcoming changes.

Signed-off-by Peter Collingbourne <[email protected]>

---
View this change in Gerrit: https://linux-review.googlesource.com/q/I4f56174e1b7b2bf4a3c8139e6879cbfd52750a24

 include/linux/signal.h |  13 ++++++
 kernel/signal.c        | 101 ++++++++++++++++-------------------------
 2 files changed, 53 insertions(+), 61 deletions(-)

include/linux/signal.h +13 -0

index 6bb1a3f0258c..3edbf54493ee 100644
@@ -50,6 +50,19 @@ enum siginfo_layout {
 
 enum siginfo_layout siginfo_layout(unsigned sig, int si_code);
 
+static inline bool siginfo_layout_is_fault(enum siginfo_layout layout)
+{
+     switch (layout) {
+     case SIL_FAULT:
+     case SIL_FAULT_MCEERR:
+     case SIL_FAULT_BNDERR:
+     case SIL_FAULT_PKUERR:
+             return true;
+     default:
+             return false;
+     }
+}
+
 /*
  * Define some primitives to manipulate sigset_t.
  */

kernel/signal.c +19 -27

index c80e70bde11d..4ee9dc03f20f 100644
@@ -1649,6 +1649,15 @@ void force_sigsegv(int sig)
      force_sig(SIGSEGV);
 }
 
+static void set_sigfault_common_fields(struct kernel_siginfo *info, int sig,
+                                    int code, void __user *addr)
+{
+     info->si_signo = sig;
+     info->si_errno = 0;
+     info->si_code = code;
+     info->si_addr = addr;
+}
+
 int force_sig_fault_to_task(int sig, int code, void __user *addr
      ___ARCH_SI_TRAPNO(int trapno)
      ___ARCH_SI_IA64(int imm, unsigned int flags, unsigned long isr)

@@ -1657,10 +1666,7 @@ int force_sig_fault_to_task(int sig, int code, void __user *addr
      struct kernel_siginfo info;
 
      clear_siginfo(&info);
-     info.si_signo = sig;
-     info.si_errno = 0;
-     info.si_code  = code;
-     info.si_addr  = addr;
+     set_sigfault_common_fields(&info, sig, code, addr);
 #ifdef __ARCH_SI_TRAPNO
      info.si_trapno = trapno;
 #endif

@@ -1689,10 +1695,7 @@ int send_sig_fault(int sig, int code, void __user *addr
      struct kernel_siginfo info;
 
      clear_siginfo(&info);
-     info.si_signo = sig;
-     info.si_errno = 0;
-     info.si_code  = code;
-     info.si_addr  = addr;
+     set_sigfault_common_fields(&info, sig, code, addr);
 #ifdef __ARCH_SI_TRAPNO
      info.si_trapno = trapno;
 #endif

@@ -1710,10 +1713,7 @@ int force_sig_mceerr(int code, void __user *addr, short lsb)
 
      WARN_ON((code != BUS_MCEERR_AO) && (code != BUS_MCEERR_AR));
      clear_siginfo(&info);
-     info.si_signo = SIGBUS;
-     info.si_errno = 0;
-     info.si_code = code;
-     info.si_addr = addr;
+     set_sigfault_common_fields(&info, SIGBUS, code, addr);
      info.si_addr_lsb = lsb;
      return force_sig_info(&info);
 }

@@ -1724,10 +1724,7 @@ int send_sig_mceerr(int code, void __user *addr, short lsb, struct task_struct *
 
      WARN_ON((code != BUS_MCEERR_AO) && (code != BUS_MCEERR_AR));
      clear_siginfo(&info);
-     info.si_signo = SIGBUS;
-     info.si_errno = 0;
-     info.si_code = code;
-     info.si_addr = addr;
+     set_sigfault_common_fields(&info, SIGBUS, code, addr);
      info.si_addr_lsb = lsb;
      return send_sig_info(info.si_signo, &info, t);
 }

@@ -1738,10 +1735,7 @@ int force_sig_bnderr(void __user *addr, void __user *lower, void __user *upper)
      struct kernel_siginfo info;
 
      clear_siginfo(&info);
-     info.si_signo = SIGSEGV;
-     info.si_errno = 0;
-     info.si_code  = SEGV_BNDERR;
-     info.si_addr  = addr;
+     set_sigfault_common_fields(&info, SIGSEGV, SEGV_BNDERR, addr);
      info.si_lower = lower;
      info.si_upper = upper;
      return force_sig_info(&info);

@@ -1753,10 +1747,7 @@ int force_sig_pkuerr(void __user *addr, u32 pkey)
      struct kernel_siginfo info;
 
      clear_siginfo(&info);
-     info.si_signo = SIGSEGV;
-     info.si_errno = 0;
-     info.si_code  = SEGV_PKUERR;
-     info.si_addr  = addr;
+     set_sigfault_common_fields(&info, SIGSEGV, SEGV_PKUERR, addr);
      info.si_pkey  = pkey;
      return force_sig_info(&info);
 }

@@ -1770,10 +1761,8 @@ int force_sig_ptrace_errno_trap(int errno, void __user *addr)
      struct kernel_siginfo info;
 
      clear_siginfo(&info);
-     info.si_signo = SIGTRAP;
+     set_sigfault_common_fields(&info, SIGTRAP, TRAP_HWBKPT, addr);
      info.si_errno = errno;
-     info.si_code  = TRAP_HWBKPT;
-     info.si_addr  = addr;
      return force_sig_info(&info);
 }
 

@@ -3266,12 +3255,23 @@ int copy_siginfo_from_user(kernel_siginfo_t *to, const siginfo_t __user *from)
 void copy_siginfo_to_external32(struct compat_siginfo *to,
              const struct kernel_siginfo *from)
 {
+     enum siginfo_layout layout =
+             siginfo_layout(from->si_signo, from->si_code);
+
      memset(to, 0, sizeof(*to));
 
      to->si_signo = from->si_signo;
      to->si_errno = from->si_errno;
      to->si_code  = from->si_code;

kernel/signal.c int copy_siginfo_from_user(kernel_siginfo_t *to, const siginfo_t __user *from) · line 3274

Quoted 10 lines

kernel/signal.c +9 -1

-     switch(siginfo_layout(from->si_signo, from->si_code)) {
+
+     if (siginfo_layout_is_fault(layout)) {
+             to->si_addr = ptr_to_compat(from->si_addr);
+#ifdef __ARCH_SI_TRAPNO
+             to->si_trapno = from->si_trapno;
+#endif
+     }
+
+     switch (layout) {

I find the code flow slightly awkward with this change, because the fault signal fields are populated partly in the if() above and partly in the switch(). Previously, only the universal stuff was done outside.

Quoted 5 lines

Would this be easier on future maintainers if we pulled the common stuff out into a helper and then called it from the appropriate switch cases? The compiler will probably output some duplicated code in that case (depending on how clever it is at undoing the duplication), but the amount of affected code is small.

I'm not sure about that. One advantage of the current code structure is that we end up with siginfo_layout_is_fault containing our single canonical list of layouts that use the sigfault union member. With your proposed code structure, the only caller of siginfo_layout_is_fault would be the code that the next patch adds to kernel/ptrace.c, which needs to know which layouts use sigfault so that it can clear si_xflags, and that could relatively easily get out of sync by accident since it's dealing with a less common case.

That being said, perhaps we could say that a caller of ptrace(PTRACE_SETSIGINFO) is by definition old, so it wouldn't be using that API to send signals with new siginfo layouts. That would preclude a client from upgrading its knowledge of si_xflags independently of its knowledge of new layouts though, and there would be nothing preventing a new caller of siginfo_layout_is_fault being added that would be exposed to new user code.

This field will contain flags that may be used by signal handlers to determine whether other fields in the _sigfault portion of siginfo are valid. An example use case is the following patch, which introduces the si_addr_ignored_bits{,_mask} fields.

A new sigcontext flag, SA_XFLAGS, is introduced in order to allow a signal handler to require the kernel to set the field (but note that the field will be set anyway if the kernel supports the flag, regardless of its value). In combination with the previous patches, this allows a userspace program to determine whether the kernel will set the field.

It is possible for an si_xflags-unaware program to cause a signal handler in an si_xflags-aware program to be called with a provided siginfo data structure by using one of the following syscalls:

- ptrace(PTRACE_SETSIGINFO)
- pidfd_send_signal
- rt_sigqueueinfo
- rt_tgsigqueueinfo

So we need to prevent the si_xflags-unaware program from causing an uninitialized read of si_xflags in the si_xflags-aware program when it uses one of these syscalls.

The last three cases can be handled by observing that each of these syscalls fails if si_code >= 0, so we define si_xflags to only be valid if si_code >= 0.

There is no such check on si_code in ptrace(PTRACE_SETSIGINFO), so we make ptrace(PTRACE_SETSIGINFO) clear the si_xflags field if it detects that the signal would use the _sigfault layout, and introduce a new ptrace request type, PTRACE_SETSIGINFO2, that a si_xflags-aware program may use to opt out of this behavior.

It is also possible for the kernel to inject a signal specified to use _sigfault by calling force_sig (e.g. there are numerous calls to force_sig(SIGSEGV)). In this case si_code is set to SI_KERNEL and the _kill union member is used, so document that si_code must be < SI_KERNEL.

Ideally this field could have just been named si_flags, but that name was already taken by ia64, so a different name was chosen.

Alternatively, we may consider making ia64's si_flags a generic field and having it appear at the end of _sigfault (in the same place as this patch has si_xflags) on non-ia64, keeping it in the same place on ia64. ia64's si_flags is a 32-bit field with only one flag bit allocated, so we would have 31 bits to use if we do this.

Signed-off-by Peter Collingbourne <[email protected]>

---
View this change in Gerrit: https://linux-review.googlesource.com/q/Ide155ce29366c3eab2a944ae4c51205982e5b8b2

v10:
- make the new field compatible with the various ways that a siginfo can be injected from another process
- eliminate some duplication by adding a refactoring patch before this one

 arch/powerpc/platforms/powernv/vas-fault.c |  1 +
 arch/x86/kernel/signal_compat.c            |  4 +--
 include/linux/compat.h                     |  2 ++
 include/linux/signal_types.h               |  2 +-
 include/uapi/asm-generic/siginfo.h         |  4 +++
 include/uapi/asm-generic/signal-defs.h     |  4 +++
 include/uapi/linux/ptrace.h                |  2 ++
 kernel/ptrace.c                            | 29 ++++++++++++++++++++++
 kernel/signal.c                            |  3 +++
 9 files changed, 48 insertions(+), 3 deletions(-)

arch/powerpc/platforms/powernv/vas-fault.c +1 -0

index 3d21fce254b7..3bbb335561f5 100644
@@ -154,6 +154,7 @@ static void update_csb(struct vas_window *window,
 	info.si_errno = EFAULT;
 	info.si_code = SEGV_MAPERR;
 	info.si_addr = csb_addr;
+	info.si_xflags = 0;
 
 	/*
 	 * process will be polling on csb.flags after request is sent to

arch/x86/kernel/signal_compat.c +0 -0

index c599013ae8cb..6b99f0c8a068 100644

arch/x86/kernel/signal_compat.c +0 -0

 	BUILD_BUG_ON(offsetof(siginfo_t, si_addr) != 0x10);
 	BUILD_BUG_ON(offsetof(compat_siginfo_t, si_addr) != 0x0C);

include/linux/compat.h +0 -0

index d38c4d7e83bd..55d4228dfd88 100644

include/linux/compat.h +0 -0

 		} _sigfault;
 
 		/* SIGPOLL */

include/linux/signal_types.h +1 -1

index a7887ad84d36..75ca861d982a 100644
@@ -78,6 +78,6 @@ struct ksignal {
 
 #define UAPI_SA_FLAGS                                                          \
 	(SA_NOCLDSTOP | SA_NOCLDWAIT | SA_SIGINFO | SA_ONSTACK | SA_RESTART |  \
-	 SA_NODEFER | SA_RESETHAND | __ARCH_UAPI_SA_FLAGS)
+	 SA_NODEFER | SA_RESETHAND | SA_XFLAGS | __ARCH_UAPI_SA_FLAGS)
 
 #endif /* _LINUX_SIGNAL_TYPES_H */

include/uapi/asm-generic/siginfo.h +0 -0

index cb3d6c267181..1fbd88d64f38 100644

include/uapi/asm-generic/siginfo.h +3 -0

 		};
+		unsigned long _xflags;
 	} _sigfault;
 
 	/* SIGPOLL */

@@ -152,6 +154,8 @@ typedef struct siginfo {
 #define si_trapno	_sifields._sigfault._trapno
 #endif
 #define si_addr_lsb	_sifields._sigfault._addr_lsb
+/* si_xflags is only valid if 0 <= si_code < SI_KERNEL */
+#define si_xflags	_sifields._sigfault._xflags
 #define si_lower	_sifields._sigfault._addr_bnd._lower
 #define si_upper	_sifields._sigfault._addr_bnd._upper
 #define si_pkey		_sifields._sigfault._addr_pkey._pkey

include/uapi/asm-generic/signal-defs.h +0 -0

index e853cbe8722d..bdbe1fe7a779 100644

On Fri, Aug 21, 2020 at 10:10:16PM -0700, Peter Collingbourne wrote:

[ Add a new siginfo member sa_xflags, for fault signals. ]

Quoted 21 lines

This field will contain flags that may be used by signal handlers to determine whether other fields in the _sigfault portion of siginfo are valid. An example use case is the following patch, which introduces the si_addr_ignored_bits{,_mask} fields.

A new sigcontext flag, SA_XFLAGS, is introduced in order to allow a signal handler to require the kernel to set the field (but note that the field will be set anyway if the kernel supports the flag, regardless of its value). In combination with the previous patches, this allows a userspace program to determine whether the kernel will set the field.

It is possible for an si_xflags-unaware program to cause a signal handler in an si_xflags-aware program to be called with a provided siginfo data structure by using one of the following syscalls:

- ptrace(PTRACE_SETSIGINFO)
- pidfd_send_signal
- rt_sigqueueinfo
- rt_tgsigqueueinfo

Quoted 7 lines

So we need to prevent the si_xflags-unaware program from causing an uninitialized read of si_xflags in the si_xflags-aware program when it uses one of these syscalls.

The last three cases can be handled by observing that each of these syscalls fails if si_code >= 0, so we define si_xflags to only be valid if si_code >= 0.

I would say >. 0 is SI_USER, and the fact that those other interfaces reject SI_USER seems inconsistent or a bug.

We can always relax the rule later.

Since si_xflags only makes sense for "real" fault signals, it would never be applicable in combination with SI_USER. Or am I missing something?

Either way, I think this is just a documentation ossue in practice.

Quoted 6 lines

There is no such check on si_code in ptrace(PTRACE_SETSIGINFO), so we make ptrace(PTRACE_SETSIGINFO) clear the si_xflags field if it detects that the signal would use the _sigfault layout, and introduce a new ptrace request type, PTRACE_SETSIGINFO2, that a si_xflags-aware program may use to opt out of this behavior.

Will we need to introduce PTRACE_SETSIGINFO3, 4 etc., every time a new field comes up?

I wonder whether we should make this more flexible, say accepting some flags argument to say which fields the caller understands (and so doesn't want clobbered). Maybe we can (ab)use the sa_flags bit definitions for indicating which extensions the caller understands.

Quoted 4 lines

It is also possible for the kernel to inject a signal specified to use _sigfault by calling force_sig (e.g. there are numerous calls to force_sig(SIGSEGV)). In this case si_code is set to SI_KERNEL and the _kill union member is used, so document that si_code must be < SI_KERNEL.

Ack. I'm still wondering if some of those SIGSEGV/SI_KERNEL instances should be changed to one of the standard SIGSEGV codes, but either way, having si_xflags validity require si_code < SI_KERNEL seems appropriate.

Quoted 8 lines

Ideally this field could have just been named si_flags, but that name was already taken by ia64, so a different name was chosen.

Alternatively, we may consider making ia64's si_flags a generic field and having it appear at the end of _sigfault (in the same place as this patch has si_xflags) on non-ia64, keeping it in the same place on ia64. ia64's si_flags is a 32-bit field with only one flag bit allocated, so we would have 31 bits to use if we do this.

Hmm, that might be an idea.

It would mean that x86 would have different rules from other architectures regarding how to know when the field is valid, which might lull x86-first projects into a false sense of security. Perhaps we could

refuse to expose any of the arch-independent flags in si_flags unless explicitly requested via SA_XFLAGS, but that would be a departure from what this series implements today.

So maybe it's simpler to keep the two fields separate, unless somebody objects.

Quoted 39 lines

Signed-off-by Peter Collingbourne <[email protected]>

---
View this change in Gerrit: https://linux-review.googlesource.com/q/Ide155ce29366c3eab2a944ae4c51205982e5b8b2

v10:
- make the new field compatible with the various ways that a siginfo can be injected from another process
- eliminate some duplication by adding a refactoring patch before this one

 arch/powerpc/platforms/powernv/vas-fault.c |  1 +
 arch/x86/kernel/signal_compat.c            |  4 +--
 include/linux/compat.h                     |  2 ++
 include/linux/signal_types.h               |  2 +-
 include/uapi/asm-generic/siginfo.h         |  4 +++
 include/uapi/asm-generic/signal-defs.h     |  4 +++
 include/uapi/linux/ptrace.h                |  2 ++
 kernel/ptrace.c                            | 29 ++++++++++++++++++++++
 kernel/signal.c                            |  3 +++
 9 files changed, 48 insertions(+), 3 deletions(-)

arch/powerpc/platforms/powernv/vas-fault.c +1 -0

index 3d21fce254b7..3bbb335561f5 100644
@@ -154,6 +154,7 @@ static void update_csb(struct vas_window *window,
      info.si_errno = EFAULT;
      info.si_code = SEGV_MAPERR;
      info.si_addr = csb_addr;
+     info.si_xflags = 0;
 
      /*
       * process will be polling on csb.flags after request is sent to

arch/x86/kernel/signal_compat.c +0 -0

index c599013ae8cb..6b99f0c8a068 100644

arch/x86/kernel/signal_compat.c static inline void signal_compat_build_tests(void) · line 125

Quoted 7 lines

arch/x86/kernel/signal_compat.c +2 -2

@@ -121,8 +121,8 @@ static inline void signal_compat_build_tests(void)
 #endif
 
      CHECK_CSI_OFFSET(_sigfault);
-     CHECK_CSI_SIZE  (_sigfault, 4*sizeof(int));
-     CHECK_SI_SIZE   (_sigfault, 8*sizeof(int));
+     CHECK_CSI_SIZE  (_sigfault, 8*sizeof(int));
+     CHECK_SI_SIZE   (_sigfault, 16*sizeof(int));

(Yuk, but at least you make this no worse.)

Quoted 8 lines

arch/x86/kernel/signal_compat.c +0 -0

      BUILD_BUG_ON(offsetof(siginfo_t, si_addr) != 0x10);
      BUILD_BUG_ON(offsetof(compat_siginfo_t, si_addr) != 0x0C);

include/linux/compat.h +0 -0

index d38c4d7e83bd..55d4228dfd88 100644

include/linux/compat.h typedef struct compat_siginfo { · line 236

Quoted 6 lines

include/linux/compat.h +2 -0

@@ -231,7 +231,9 @@ typedef struct compat_siginfo {
                                      char _dummy_pkey[__COMPAT_ADDR_BND_PKEY_PAD];
                                      u32 _pkey;
                              } _addr_pkey;
+                             compat_uptr_t _pad[6];
                      };
+                     compat_uptr_t _xflags;

Should we have the same type here for native and compat?

I don't have a very strong opinion on this, but currently native on 64-bit arches will have 32 extra bits in _xflags that can never be used (or have to be defined differently for compat).

Quoted 20 lines

include/linux/compat.h +0 -0

              } _sigfault;
 
              /* SIGPOLL */

include/linux/signal_types.h +1 -1

index a7887ad84d36..75ca861d982a 100644
@@ -78,6 +78,6 @@ struct ksignal {
 
 #define UAPI_SA_FLAGS                                                          \
      (SA_NOCLDSTOP | SA_NOCLDWAIT | SA_SIGINFO | SA_ONSTACK | SA_RESTART |  \
-      SA_NODEFER | SA_RESETHAND | __ARCH_UAPI_SA_FLAGS)
+      SA_NODEFER | SA_RESETHAND | SA_XFLAGS | __ARCH_UAPI_SA_FLAGS)
 
 #endif /* _LINUX_SIGNAL_TYPES_H */

include/uapi/asm-generic/siginfo.h +0 -0

index cb3d6c267181..1fbd88d64f38 100644

include/uapi/asm-generic/siginfo.h union __sifields { · line 94

Quoted 4 lines

include/uapi/asm-generic/siginfo.h +1 -0

@@ -91,7 +91,9 @@ union __sifields {
                              char _dummy_pkey[__ADDR_BND_PKEY_PAD];
                              __u32 _pkey;
                      } _addr_pkey;
+                     void *_pad[6];

6?

Obviously we'll need something here, but I'm curious as to where this value came from.

(Same for compat.)

Quoted 18 lines

include/uapi/asm-generic/siginfo.h +3 -0

              };
+             unsigned long _xflags;
      } _sigfault;
 
      /* SIGPOLL */

@@ -152,6 +154,8 @@ typedef struct siginfo {
 #define si_trapno    _sifields._sigfault._trapno
 #endif
 #define si_addr_lsb  _sifields._sigfault._addr_lsb
+/* si_xflags is only valid if 0 <= si_code < SI_KERNEL */
+#define si_xflags    _sifields._sigfault._xflags
 #define si_lower     _sifields._sigfault._addr_bnd._lower
 #define si_upper     _sifields._sigfault._addr_bnd._upper
 #define si_pkey              _sifields._sigfault._addr_pkey._pkey

include/uapi/asm-generic/signal-defs.h +0 -0

index e853cbe8722d..bdbe1fe7a779 100644

include/uapi/asm-generic/signal-defs.h line 24

Quoted 6 lines

include/uapi/asm-generic/signal-defs.h +2 -0

@@ -20,6 +20,9 @@
  * so this bit allows flag bit support to be detected from userspace while
  * allowing an old kernel to be distinguished from a kernel that supports every
  * flag bit.
+ * SA_XFLAGS indicates that the signal handler requires the siginfo.si_xflags
+ * field to be valid. Note that if the kernel supports SA_XFLAGS, the field will

Maybe "valid for fault signals (SIGSEGV etc.)"

[...]

Otherwise, this looks sensible overall to me.

Quoted 4 lines · Dave Martin

On Fri, Aug 21, 2020 at 10:10:16PM -0700, Peter Collingbourne wrote:

[ Add a new siginfo member sa_xflags, for fault signals. ]

Will fix.

Quoted 32 lines

Quoted 21 lines

This field will contain flags that may be used by signal handlers to determine whether other fields in the _sigfault portion of siginfo are valid. An example use case is the following patch, which introduces the si_addr_ignored_bits{,_mask} fields.

A new sigcontext flag, SA_XFLAGS, is introduced in order to allow a signal handler to require the kernel to set the field (but note that the field will be set anyway if the kernel supports the flag, regardless of its value). In combination with the previous patches, this allows a userspace program to determine whether the kernel will set the field.

It is possible for an si_xflags-unaware program to cause a signal handler in an si_xflags-aware program to be called with a provided siginfo data structure by using one of the following syscalls:

- ptrace(PTRACE_SETSIGINFO)
- pidfd_send_signal
- rt_sigqueueinfo
- rt_tgsigqueueinfo

Quoted 7 lines

So we need to prevent the si_xflags-unaware program from causing an uninitialized read of si_xflags in the si_xflags-aware program when it uses one of these syscalls.

The last three cases can be handled by observing that each of these syscalls fails if si_code >= 0, so we define si_xflags to only be valid if si_code >= 0.

I would say >. 0 is SI_USER, and the fact that those other interfaces reject SI_USER seems inconsistent or a bug.

Quoted 7 lines

We can always relax the rule later.

Since si_xflags only makes sense for "real" fault signals, it would never be applicable in combination with SI_USER. Or am I missing something?

Either way, I think this is just a documentation ossue in practice.

I think you're right. kill(2) and tgkill(2) set si_code to SI_USER, so excluding SI_USER seems to be necessary to avoid an invalid read via either of these syscalls. I will update the comment to say > 0.

Quoted 7 lines

Quoted 6 lines

There is no such check on si_code in ptrace(PTRACE_SETSIGINFO), so we make ptrace(PTRACE_SETSIGINFO) clear the si_xflags field if it detects that the signal would use the _sigfault layout, and introduce a new ptrace request type, PTRACE_SETSIGINFO2, that a si_xflags-aware program may use to opt out of this behavior.

Quoted 7 lines

Will we need to introduce PTRACE_SETSIGINFO3, 4 etc., every time a new field comes up?

I wonder whether we should make this more flexible, say accepting some flags argument to say which fields the caller understands (and so doesn't want clobbered). Maybe we can (ab)use the sa_flags bit definitions for indicating which extensions the caller understands.

I'd be okay with adding a flags argument here, to be passed via the addr argument to PTRACE_SETSIGINFO2. (Confusingly, in some of the ptrace request types including the ones that deal with siginfo "data" is the argument that takes an address and "addr" is the one that takes something else! My new request type will do the same to make things consistently confusing.)

I guess we would only require a new "out of band" signaling mechanism if we were adding a field to a different union member (presumably a flags field to support the kind of future expansion that we anticipate for sigfault), since for sigfault we may indicate presence of new fields using si_xflags. Presumably such a field would come at the same time as a new SA_* bit for detecting its presence, so I suppose that we could use the sa_flags bits here as well. I'm not entirely comfortable with that though because the other SA_* bits wouldn't make sense to be passed as an argument here (and because of the architecture dependence that made it so hard to find free SA_* bits to add, we would be unnecessarily restricted in the number of bits that we could easily add here), and in the future someone may come up with a reason to pass a new flag here that wouldn't correspond to an SA_* bit. So I would mildly prefer a new set of bit definitions.

It's unfortunate that the addr argument for PTRACE_SETSIGINFO was specified to be ignored rather than causing an error for non-zero values, as otherwise we could have used it as the flags argument to the existing request type and avoided adding a new one. Of course, this is the same issue that has caused us so much grief with sigaction. But for the new request type we can do things properly and require addr to have only recognized bits set.

Quoted 19 lines

Quoted 4 lines

It is also possible for the kernel to inject a signal specified to use _sigfault by calling force_sig (e.g. there are numerous calls to force_sig(SIGSEGV)). In this case si_code is set to SI_KERNEL and the _kill union member is used, so document that si_code must be < SI_KERNEL.

Ack. I'm still wondering if some of those SIGSEGV/SI_KERNEL instances should be changed to one of the standard SIGSEGV codes, but either way, having si_xflags validity require si_code < SI_KERNEL seems appropriate.

Quoted 8 lines

Ideally this field could have just been named si_flags, but that name was already taken by ia64, so a different name was chosen.

Alternatively, we may consider making ia64's si_flags a generic field and having it appear at the end of _sigfault (in the same place as this patch has si_xflags) on non-ia64, keeping it in the same place on ia64. ia64's si_flags is a 32-bit field with only one flag bit allocated, so we would have 31 bits to use if we do this.

Quoted 5 lines

Hmm, that might be an idea.

It would mean that x86 would have different rules from other architectures regarding how to know when the field is valid, which might lull x86-first projects into a false sense of security. Perhaps we could

ia64 is Itanium, not x86. And ia64 is almost dead (I heard that gcc was planning to remove support some time next year [1], which I expect would be followed soon after by dropping kernel support). So I wouldn't expect there to be a lot of ia64-first projects out there.

[1] https://www.phoronix.com/scan.php?page=news_item&px=Intel-IA-64-GCC-Deprecation

Quoted 6 lines

refuse to expose any of the arch-independent flags in si_flags unless explicitly requested via SA_XFLAGS, but that would be a departure from what this series implements today.

So maybe it's simpler to keep the two fields separate, unless somebody objects.

Notwithstanding the above, I would be mildly in favor of keeping them separate in order to avoid the complexity implied by entangling them, since it's complex enough to add fields here as it is.

Quoted 66 lines

Quoted 39 lines

Signed-off-by Peter Collingbourne <[email protected]>

---
View this change in Gerrit: https://linux-review.googlesource.com/q/Ide155ce29366c3eab2a944ae4c51205982e5b8b2

v10:
- make the new field compatible with the various ways that a siginfo can be injected from another process
- eliminate some duplication by adding a refactoring patch before this one

 arch/powerpc/platforms/powernv/vas-fault.c |  1 +
 arch/x86/kernel/signal_compat.c            |  4 +--
 include/linux/compat.h                     |  2 ++
 include/linux/signal_types.h               |  2 +-
 include/uapi/asm-generic/siginfo.h         |  4 +++
 include/uapi/asm-generic/signal-defs.h     |  4 +++
 include/uapi/linux/ptrace.h                |  2 ++
 kernel/ptrace.c                            | 29 ++++++++++++++++++++++
 kernel/signal.c                            |  3 +++
 9 files changed, 48 insertions(+), 3 deletions(-)

arch/powerpc/platforms/powernv/vas-fault.c +1 -0

index 3d21fce254b7..3bbb335561f5 100644
@@ -154,6 +154,7 @@ static void update_csb(struct vas_window *window,
      info.si_errno = EFAULT;
      info.si_code = SEGV_MAPERR;
      info.si_addr = csb_addr;
+     info.si_xflags = 0;
 
      /*
       * process will be polling on csb.flags after request is sent to

arch/x86/kernel/signal_compat.c +0 -0

index c599013ae8cb..6b99f0c8a068 100644

arch/x86/kernel/signal_compat.c static inline void signal_compat_build_tests(void) · line 125

Quoted 7 lines

arch/x86/kernel/signal_compat.c +2 -2

@@ -121,8 +121,8 @@ static inline void signal_compat_build_tests(void)
 #endif
 
      CHECK_CSI_OFFSET(_sigfault);
-     CHECK_CSI_SIZE  (_sigfault, 4*sizeof(int));
-     CHECK_SI_SIZE   (_sigfault, 8*sizeof(int));
+     CHECK_CSI_SIZE  (_sigfault, 8*sizeof(int));
+     CHECK_SI_SIZE   (_sigfault, 16*sizeof(int));

(Yuk, but at least you make this no worse.)

Quoted 8 lines

arch/x86/kernel/signal_compat.c +0 -0

      BUILD_BUG_ON(offsetof(siginfo_t, si_addr) != 0x10);
      BUILD_BUG_ON(offsetof(compat_siginfo_t, si_addr) != 0x0C);

include/linux/compat.h +0 -0

index d38c4d7e83bd..55d4228dfd88 100644

include/linux/compat.h typedef struct compat_siginfo { · line 236

Quoted 6 lines

include/linux/compat.h +2 -0

@@ -231,7 +231,9 @@ typedef struct compat_siginfo {
                                      char _dummy_pkey[__COMPAT_ADDR_BND_PKEY_PAD];
                                      u32 _pkey;
                              } _addr_pkey;
+                             compat_uptr_t _pad[6];
                      };
+                     compat_uptr_t _xflags;

Should we have the same type here for native and compat?

Quoted 3 lines

I don't have a very strong opinion on this, but currently native on 64-bit arches will have 32 extra bits in _xflags that can never be used (or have to be defined differently for compat).

Good point. I will make this a u64 (although I think 32 bits will probably be more than enough, the distance between si_xflags and si_addr_ignored_bits will be 8 bytes on 64-bit architectures due to alignment so we may as well make all of the bits available).

Quoted 4 lines · Peter Collingbourne

Quoted 2 lines · Dave Martin

On Fri, Aug 21, 2020 at 10:10:16PM -0700, Peter Collingbourne wrote:

Quoted 14 lines

Quoted 14 lines

include/linux/compat.h typedef struct compat_siginfo { · line 236

Quoted 11 lines

include/linux/compat.h +2 -0

index d38c4d7e83bd..55d4228dfd88 100644
@@ -231,7 +231,9 @@ typedef struct compat_siginfo {
                                      char _dummy_pkey[__COMPAT_ADDR_BND_PKEY_PAD];
                                      u32 _pkey;
                              } _addr_pkey;
+                             compat_uptr_t _pad[6];
                      };
+                     compat_uptr_t _xflags;

Should we have the same type here for native and compat?

Quoted 8 lines

Quoted 3 lines

I don't have a very strong opinion on this, but currently native on 64-bit arches will have 32 extra bits in _xflags that can never be used (or have to be defined differently for compat).

Good point. I will make this a u64 (although I think 32 bits will probably be more than enough, the distance between si_xflags and si_addr_ignored_bits will be 8 bytes on 64-bit architectures due to alignment so we may as well make all of the bits available).

It turns out that we can't actually make this a u64 because on 32-bit platforms this increases the alignment of the union to 8, which breaks layout for the other fields in the union. In v12 I will make this a u32 so that we don't end up with unusable bits.

Quoted 4 lines · Dave Martin

On Fri, Aug 21, 2020 at 10:10:16PM -0700, Peter Collingbourne wrote:

[ Add a new siginfo member sa_xflags, for fault signals. ]

Will fix.

Quoted 38 lines

Quoted 21 lines

This field will contain flags that may be used by signal handlers to determine whether other fields in the _sigfault portion of siginfo are valid. An example use case is the following patch, which introduces the si_addr_ignored_bits{,_mask} fields.

A new sigcontext flag, SA_XFLAGS, is introduced in order to allow a signal handler to require the kernel to set the field (but note that the field will be set anyway if the kernel supports the flag, regardless of its value). In combination with the previous patches, this allows a userspace program to determine whether the kernel will set the field.

It is possible for an si_xflags-unaware program to cause a signal handler in an si_xflags-aware program to be called with a provided siginfo data structure by using one of the following syscalls:

- ptrace(PTRACE_SETSIGINFO)
- pidfd_send_signal
- rt_sigqueueinfo
- rt_tgsigqueueinfo

Quoted 7 lines

So we need to prevent the si_xflags-unaware program from causing an uninitialized read of si_xflags in the si_xflags-aware program when it uses one of these syscalls.

The last three cases can be handled by observing that each of these syscalls fails if si_code >= 0, so we define si_xflags to only be valid if si_code >= 0.

I would say >. 0 is SI_USER, and the fact that those other interfaces reject SI_USER seems inconsistent or a bug.

We can always relax the rule later.

Since si_xflags only makes sense for "real" fault signals, it would never be applicable in combination with SI_USER. Or am I missing something?

Quoted 1 line

Either way, I think this is just a documentation ossue in practice.

I think you're right. kill(2) and tgkill(2) set si_code to SI_USER, so excluding SI_USER seems to be necessary to avoid an invalid read via either of these syscalls. I will update the comment to say > 0.

Quoted 6 lines

Quoted 5 lines

There is no such check on si_code in ptrace(PTRACE_SETSIGINFO), so we make ptrace(PTRACE_SETSIGINFO) clear the si_xflags field if it detects that the signal would use the _sigfault layout, and introduce a new ptrace request type, PTRACE_SETSIGINFO2, that a si_xflags-aware program may use to opt out of this behavior.

Quoted 7 lines

Will we need to introduce PTRACE_SETSIGINFO3, 4 etc., every time a new field comes up?

I wonder whether we should make this more flexible, say accepting some flags argument to say which fields the caller understands (and so doesn't want clobbered). Maybe we can (ab)use the sa_flags bit definitions for indicating which extensions the caller understands.

I'd be okay with adding a flags argument here, to be passed via the addr argument to PTRACE_SETSIGINFO2. (Confusingly, in some of the ptrace request types including the ones that deal with siginfo "data" is the argument that takes an address and "addr" is the one that takes something else! My new request type will do the same to make things consistently confusing.)

I guess we would only require a new "out of band" signaling mechanism if we were adding a field to a different union member (presumably a flags field to support the kind of future expansion that we anticipate for sigfault), since for sigfault we may indicate presence of new fields using si_xflags. Presumably such a field would come at the same time as a new SA_* bit for detecting its presence, so I suppose that

we could use the sa_flags bits here as well. I'm not entirely comfortable with that though because the other SA_* bits wouldn't make sense to be passed as an argument here (and because of the architecture dependence that made it so hard to find free SA_* bits to add, we would be unnecessarily restricted in the number of bits that we could easily add here), and in the future someone may come up with a reason to pass a new flag here that wouldn't correspond to an SA_* bit. So I would mildly prefer a new set of bit definitions.

It's unfortunate that the addr argument for PTRACE_SETSIGINFO was specified to be ignored rather than causing an error for non-zero values, as otherwise we could have used it as the flags argument to the existing request type and avoided adding a new one. Of course, this is the same issue that has caused us so much grief with sigaction. But for the new request type we can do things properly and require addr to have only recognized bits set.

Quoted 19 lines

Quoted 4 lines

It is also possible for the kernel to inject a signal specified to use _sigfault by calling force_sig (e.g. there are numerous calls to force_sig(SIGSEGV)). In this case si_code is set to SI_KERNEL and the _kill union member is used, so document that si_code must be < SI_KERNEL.

Ack. I'm still wondering if some of those SIGSEGV/SI_KERNEL instances should be changed to one of the standard SIGSEGV codes, but either way, having si_xflags validity require si_code < SI_KERNEL seems appropriate.

Quoted 8 lines

Ideally this field could have just been named si_flags, but that name was already taken by ia64, so a different name was chosen.

Alternatively, we may consider making ia64's si_flags a generic field and having it appear at the end of _sigfault (in the same place as this patch has si_xflags) on non-ia64, keeping it in the same place on ia64. ia64's si_flags is a 32-bit field with only one flag bit allocated, so we would have 31 bits to use if we do this.

Quoted 5 lines

Hmm, that might be an idea.

It would mean that x86 would have different rules from other architectures regarding how to know when the field is valid, which might lull x86-first projects into a false sense of security. Perhaps we could

ia64 is Itanium, not x86. And ia64 is almost dead (I heard that gcc was planning to remove support some time next year [1], which I expect would be followed soon after by dropping kernel support). So I wouldn't expect there to be a lot of ia64-first projects out there.

[1] https://www.phoronix.com/scan.php?page=news_item&px=Intel-IA-64-GCC-Deprecation

Quoted 6 lines

refuse to expose any of the arch-independent flags in si_flags unless explicitly requested via SA_XFLAGS, but that would be a departure from what this series implements today.

So maybe it's simpler to keep the two fields separate, unless somebody objects.

Notwithstanding the above, I would be mildly in favor of keeping them separate in order to avoid the complexity implied by entangling them, since it's complex enough to add fields here as it is.

Quoted 66 lines

Quoted 39 lines

Signed-off-by Peter Collingbourne <[email protected]>

---
View this change in Gerrit: https://linux-review.googlesource.com/q/Ide155ce29366c3eab2a944ae4c51205982e5b8b2

v10:
- make the new field compatible with the various ways that a siginfo can be injected from another process
- eliminate some duplication by adding a refactoring patch before this one

 arch/powerpc/platforms/powernv/vas-fault.c |  1 +
 arch/x86/kernel/signal_compat.c            |  4 +--
 include/linux/compat.h                     |  2 ++
 include/linux/signal_types.h               |  2 +-
 include/uapi/asm-generic/siginfo.h         |  4 +++
 include/uapi/asm-generic/signal-defs.h     |  4 +++
 include/uapi/linux/ptrace.h                |  2 ++
 kernel/ptrace.c                            | 29 ++++++++++++++++++++++
 kernel/signal.c                            |  3 +++
 9 files changed, 48 insertions(+), 3 deletions(-)

arch/powerpc/platforms/powernv/vas-fault.c +1 -0

index 3d21fce254b7..3bbb335561f5 100644
@@ -154,6 +154,7 @@ static void update_csb(struct vas_window *window,
      info.si_errno = EFAULT;
      info.si_code = SEGV_MAPERR;
      info.si_addr = csb_addr;
+     info.si_xflags = 0;
 
      /*
       * process will be polling on csb.flags after request is sent to

arch/x86/kernel/signal_compat.c +0 -0

index c599013ae8cb..6b99f0c8a068 100644

arch/x86/kernel/signal_compat.c static inline void signal_compat_build_tests(void) · line 125

Quoted 7 lines

arch/x86/kernel/signal_compat.c +2 -2

@@ -121,8 +121,8 @@ static inline void signal_compat_build_tests(void)
 #endif
 
      CHECK_CSI_OFFSET(_sigfault);
-     CHECK_CSI_SIZE  (_sigfault, 4*sizeof(int));
-     CHECK_SI_SIZE   (_sigfault, 8*sizeof(int));
+     CHECK_CSI_SIZE  (_sigfault, 8*sizeof(int));
+     CHECK_SI_SIZE   (_sigfault, 16*sizeof(int));

(Yuk, but at least you make this no worse.)

Quoted 8 lines

arch/x86/kernel/signal_compat.c +0 -0

      BUILD_BUG_ON(offsetof(siginfo_t, si_addr) != 0x10);
      BUILD_BUG_ON(offsetof(compat_siginfo_t, si_addr) != 0x0C);

include/linux/compat.h +0 -0

index d38c4d7e83bd..55d4228dfd88 100644

include/linux/compat.h typedef struct compat_siginfo { · line 236

Quoted 6 lines

include/linux/compat.h +2 -0

@@ -231,7 +231,9 @@ typedef struct compat_siginfo {
                                      char _dummy_pkey[__COMPAT_ADDR_BND_PKEY_PAD];
                                      u32 _pkey;
                              } _addr_pkey;
+                             compat_uptr_t _pad[6];
                      };
+                     compat_uptr_t _xflags;

Should we have the same type here for native and compat?

Quoted 3 lines

I don't have a very strong opinion on this, but currently native on 64-bit arches will have 32 extra bits in _xflags that can never be used (or have to be defined differently for compat).

Good point. I will make this a u64 (although I think 32 bits will probably be more than enough, the distance between si_xflags and si_addr_ignored_bits will be 8 bytes on 64-bit architectures due to alignment so we may as well make all of the bits available).

Quoted 30 lines

Quoted 20 lines

include/linux/compat.h +0 -0

              } _sigfault;
 
              /* SIGPOLL */

include/linux/signal_types.h +1 -1

index a7887ad84d36..75ca861d982a 100644
@@ -78,6 +78,6 @@ struct ksignal {
 
 #define UAPI_SA_FLAGS                                                          \
      (SA_NOCLDSTOP | SA_NOCLDWAIT | SA_SIGINFO | SA_ONSTACK | SA_RESTART |  \
-      SA_NODEFER | SA_RESETHAND | __ARCH_UAPI_SA_FLAGS)
+      SA_NODEFER | SA_RESETHAND | SA_XFLAGS | __ARCH_UAPI_SA_FLAGS)
 
 #endif /* _LINUX_SIGNAL_TYPES_H */

include/uapi/asm-generic/siginfo.h +0 -0

index cb3d6c267181..1fbd88d64f38 100644

include/uapi/asm-generic/siginfo.h union __sifields { · line 94

Quoted 4 lines

include/uapi/asm-generic/siginfo.h +1 -0

@@ -91,7 +91,9 @@ union __sifields {
                              char _dummy_pkey[__ADDR_BND_PKEY_PAD];
                              __u32 _pkey;
                      } _addr_pkey;
+                     void *_pad[6];

6?

Obviously we'll need something here, but I'm curious as to where this value came from.

Quoted 1 line

(Same for compat.)

I think it came from Eric's suggestion in [1], i.e. 2 words from the existing fields plus the 4 words of padding suggested by Eric.

[1] https://www.spinics.net/lists/arm-kernel/msg808618.html

Quoted 19 lines

Quoted 19 lines

include/uapi/asm-generic/siginfo.h +3 -0

              };
+             unsigned long _xflags;
      } _sigfault;
 
      /* SIGPOLL */

@@ -152,6 +154,8 @@ typedef struct siginfo {
 #define si_trapno    _sifields._sigfault._trapno
 #endif
 #define si_addr_lsb  _sifields._sigfault._addr_lsb
+/* si_xflags is only valid if 0 <= si_code < SI_KERNEL */
+#define si_xflags    _sifields._sigfault._xflags
 #define si_lower     _sifields._sigfault._addr_bnd._lower
 #define si_upper     _sifields._sigfault._addr_bnd._upper
 #define si_pkey              _sifields._sigfault._addr_pkey._pkey

include/uapi/asm-generic/signal-defs.h +0 -0

index e853cbe8722d..bdbe1fe7a779 100644

Quoted 8 lines

include/uapi/asm-generic/signal-defs.h line 24

Quoted 6 lines

include/uapi/asm-generic/signal-defs.h +2 -0

@@ -20,6 +20,9 @@
  * so this bit allows flag bit support to be detected from userspace while
  * allowing an old kernel to be distinguished from a kernel that supports every
  * flag bit.
+ * SA_XFLAGS indicates that the signal handler requires the siginfo.si_xflags
+ * field to be valid. Note that if the kernel supports SA_XFLAGS, the field will

Maybe "valid for fault signals (SIGSEGV etc.)"

Will add.

Quoted 3 lines

[...]

Otherwise, this looks sensible overall to me.

Thanks for the review. (And apologies for being slow to respond to your reviews. I got preempted by another task right after sending out v10 and only now did I get a chance to get back to this.)