[BZ #22637] Fix stack guard size accounting

Previously if user requested S stack and G guard when creating a
thread, the total mapping was S and the actual available stack was
S - G - static_tls, which is not what the user requested.

This patch fixes the guard size accounting by pretending the user
requested S+G stack.  This way all later logic works out except
when reporting the user requested stack size (pthread_getattr_np)
or when computing the minimal stack size (__pthread_get_minstack).

Normally this will increase thread stack allocations by one page.
TLS accounting is not affected, that will require a separate fix.

	[BZ #22637]
	* nptl/descr.h (stackblock, stackblock_size): Update comments.
	* nptl/allocatestack.c (allocate_stack): Add guardsize to stacksize.
	* nptl/nptl-init.c (__pthread_get_minstack): Remove guardsize from
	stacksize.
	* nptl/pthread_getattr_np.c (pthread_getattr_np): Likewise.

(cherry picked from commit 630f4cc3aa019ede55976ea561f1a7af2f068639)

diff --git a/ChangeLog b/ChangeLog
index 988615f03b538a295f11095322bb26551bc3fbd4..7f37d678be2ea5ea59c1fb439ae04266ec385bb3 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,12 @@
+2018-01-08  Szabolcs Nagy  <szabolcs.nagy@arm.com>
+
+       [BZ #22637]
+       * nptl/descr.h (stackblock, stackblock_size): Update comments.
+       * nptl/allocatestack.c (allocate_stack): Add guardsize to stacksize.
+       * nptl/nptl-init.c (__pthread_get_minstack): Remove guardsize from
+       stacksize.
+       * nptl/pthread_getattr_np.c (pthread_getattr_np): Likewise.
+
 2018-05-23  Andreas Schwab  <schwab@suse.de>
 
        [BZ #23196]

diff --git a/NEWS b/NEWS
index 13ac8dd9116aa3ca4daa53f3823b0525ed8b7ec7..f2e9b3bf9f91f9ea849a86db6ee5b5a57b0480a3 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -71,6 +71,7 @@ The following bugs are resolved with this release:
   [21609] x86-64: Align the stack in __tls_get_addr
   [21624] Unsafe alloca allows local attackers to alias stack and heap (CVE-2017-1000366)
   [21654] nss: Fix invalid cast in group merging
+  [22637] nptl: Fix stack guard size accounting
   [22644] string: memmove-sse2-unaligned on 32bit x86 produces garbage when
     crossing 2GB threshold (CVE-2017-18269)
   [22715] x86-64: Properly align La_x86_64_retval to VEC_SIZE

diff --git a/nptl/allocatestack.c b/nptl/allocatestack.c
index 7365ca606b66515f2c758464cedda853556accd7..9aba97fe7c81bb255111dee0ec619b8c87496939 100644 (file)
--- a/nptl/allocatestack.c
+++ b/nptl/allocatestack.c
@@ -484,6 +484,10 @@ allocate_stack (const struct pthread_attr *attr, struct pthread **pdp,
       /* Make sure the size of the stack is enough for the guard and
         eventually the thread descriptor.  */
       guardsize = (attr->guardsize + pagesize_m1) & ~pagesize_m1;
+      if (guardsize < attr->guardsize || size + guardsize < guardsize)
+       /* Arithmetic overflow.  */
+       return EINVAL;
+      size += guardsize;
       if (__builtin_expect (size < ((guardsize + __static_tls_size
                                     + MINIMAL_REST_STACK + pagesize_m1)
                                    & ~pagesize_m1),

diff --git a/nptl/descr.h b/nptl/descr.h
index bc92abf0101a3895e88d4058f901569eacb092a1..7e62c3cb23f50e49bd9f88bf7489ad1293aac968 100644 (file)
--- a/nptl/descr.h
+++ b/nptl/descr.h
@@ -363,9 +363,9 @@ struct pthread
   /* Machine-specific unwind info.  */
   struct _Unwind_Exception exc;
 
-  /* If nonzero pointer to area allocated for the stack and its
-     size.  */
+  /* If nonzero, pointer to the area allocated for the stack and guard. */
   void *stackblock;
+  /* Size of the stackblock area including the guard.  */
   size_t stackblock_size;
   /* Size of the included guard area.  */
   size_t guardsize;

diff --git a/nptl/nptl-init.c b/nptl/nptl-init.c
index 48fab50c4ead43479cb0541170a839052257e52d..4dabb647226528b226d93d99abe2b1ea7c29452f 100644 (file)
--- a/nptl/nptl-init.c
+++ b/nptl/nptl-init.c
@@ -493,8 +493,5 @@ strong_alias (__pthread_initialize_minimal_internal,
 size_t
 __pthread_get_minstack (const pthread_attr_t *attr)
 {
-  struct pthread_attr *iattr = (struct pthread_attr *) attr;
-
-  return (GLRO(dl_pagesize) + __static_tls_size + PTHREAD_STACK_MIN
-         + iattr->guardsize);
+  return GLRO(dl_pagesize) + __static_tls_size + PTHREAD_STACK_MIN;
 }

diff --git a/nptl/pthread_getattr_np.c b/nptl/pthread_getattr_np.c
index 32d7484bf8a29c614a7b8ab59cc67ede96e17c47..c2dfa13fa99ff1fd3af2ca3e6b41ef5cc4465545 100644 (file)
--- a/nptl/pthread_getattr_np.c
+++ b/nptl/pthread_getattr_np.c
@@ -57,9 +57,12 @@ pthread_getattr_np (pthread_t thread_id, pthread_attr_t *attr)
   /* The sizes are subject to alignment.  */
   if (__glibc_likely (thread->stackblock != NULL))
     {
-      iattr->stacksize = thread->stackblock_size;
+      /* The stack size reported to the user should not include the
+        guard size.  */
+      iattr->stacksize = thread->stackblock_size - thread->guardsize;
 #if _STACK_GROWS_DOWN
-      iattr->stackaddr = (char *) thread->stackblock + iattr->stacksize;
+      iattr->stackaddr = (char *) thread->stackblock
+                        + thread->stackblock_size;
 #else
       iattr->stackaddr = (char *) thread->stackblock;
 #endif