Re: x32 is broken in 4.9-rc1 due to "x86/signal: Add SA_{X32,IA32}_ABI sa_flags"

[Dmitry Safonov <0x7f454c46@gmail.com>]

[-- Attachment #1: Type: text/plain, Size: 2254 bytes --]

2016-10-19 20:33 GMT+03:00 Mikulas Patocka <mpatocka@redhat.com>:
>
>
> On Wed, 19 Oct 2016, Mikulas Patocka wrote:
>
>> Hi
>>
>> In the kernel 4.9-rc1, the x32 support is seriously broken, a x32 process
>> is killed with SIGKILL after returning from any signal handler.
>
> I should have said they are killed with SIGSEGV, not SIGKILL.
>
>> I use Debian sid x64-64 distribution with x32 architecture added from
>> debian-ports.
>>
>> I bisected the bug and found out that it is caused by the patch
>> 6846351052e685c2d1428e80ead2d7ca3d7ed913 ("x86/signal: Add
>> SA_{X32,IA32}_ABI sa_flags").
>>
>> example (strace of a process after receiving the SIGWINCH signal):
>>
>> epoll_wait(10, 0xef6890, 32, -1)        = -1 EINTR (Interrupted system call)
>> --- SIGWINCH {si_signo=SIGWINCH, si_code=SI_USER, si_pid=1772, si_uid=0} ---
>> poll([{fd=4, events=POLLOUT}], 1, 0)    = 1 ([{fd=4, revents=POLLOUT}])
>> write(4, "\0", 1)                       = 1
>> rt_sigreturn({mask=[INT QUIT ILL TRAP BUS KILL SEGV USR2 PIPE ALRM STKFLT TSTP TTOU URG XCPU XFSZ VTALRM IO PWR SYS RTMIN]}) = 0
>> --- SIGSEGV {si_signo=SIGSEGV, si_code=SI_KERNEL, si_addr=NULL} ---
>> +++ killed by SIGSEGV +++
>> Neoprávnìný pøístup do pamìti (SIGSEGV)
>>
>> Mikulas
>
> BTW. when I take core dump of the killed x32 process, it shows:
>
> ELF Header:
>   Magic:   7f 45 4c 46 01 01 01 00 00 00 00 00 00 00 00 00
>   Class:                             ELF32
>   Data:                              2's complement, little endian
>   Version:                           1 (current)
>   OS/ABI:                            UNIX - System V
>   ABI Version:                       0
>   Type:                              CORE (Core file)
>   Machine:                           Intel 80386
>                                 ^^^^^^^^^^^^^^^^^^^
>
> So, the kernel somehow thinks that it is i386 process, not x32 process. A
> core dump of a real x32 process shows "Class: ELF32, Machine: Advanced
> Micro Devices X86-64".

Hi Mikulas,

could you give attached patch a shot?
In about 10 hours I'll be at work and will have debian-x32 install,
but for now, I can't test it.
Thanks again on catching that.

-- 
             Dmitry

[-- Attachment #2: 0001-x86-signal-set-SA_X32_ABI-flag-for-x32-programs.patch --]
[-- Type: text/x-patch, Size: 1139 bytes --]

From a546f8da1d12676fe79c746d859eb1e17aa4c331 Mon Sep 17 00:00:00 2001
From: Dmitry Safonov <0x7f454c46@gmail.com>
Date: Thu, 20 Oct 2016 00:53:08 +0300
Subject: [PATCH] x86/signal: set SA_X32_ABI flag for x32 programs

For x32 programs cs register is __USER_CS, so it returns here
unconditionally - remove this check completely here.

Fixes: commit 6846351052e6 ("x86/signal: Add SA_{X32,IA32}_ABI sa_flags")

Reported-by: Mikulas Patocka <mpatocka@redhat.com>
Signed-off-by: Dmitry Safonov <0x7f454c46@gmail.com>
---
 arch/x86/kernel/signal_compat.c | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/arch/x86/kernel/signal_compat.c b/arch/x86/kernel/signal_compat.c
index 40df33753bae..ec1f756f9dc9 100644
--- a/arch/x86/kernel/signal_compat.c
+++ b/arch/x86/kernel/signal_compat.c
@@ -105,9 +105,6 @@ void sigaction_compat_abi(struct k_sigaction *act, struct k_sigaction *oact)
 	/* Don't let flags to be set from userspace */
 	act->sa.sa_flags &= ~(SA_IA32_ABI | SA_X32_ABI);
 
-	if (user_64bit_mode(current_pt_regs()))
-		return;
-
 	if (in_ia32_syscall())
 		act->sa.sa_flags |= SA_IA32_ABI;
 	if (in_x32_syscall())
-- 
2.10.0