| Message ID | 20240611075650.814397-3-dev.jain@arm.com |
|---|---|
| State | Superseded |
| Headers | show |
| Series | Add test to distinguish between thread's signal mask and ucontext_t | expand |
On 6/11/24 16:55, Mark Brown wrote: > On Tue, Jun 11, 2024 at 01:26:50PM +0530, Dev Jain wrote: > >> + * A signal is said to be delivered, when the program takes action on the >> + * signal: such action may involve termination of the process, ignoring the >> + * signal, terminating with core dump, stopping the process, or continuing the >> + * process if it was currently stopped. A signal is said to be blocked when the >> + * program refuses to take any of the above actions; note that, this is not the >> + * same as ignoring the signal. At a later time, the program may unblock the >> + * signal and then it will have to take one of the five actions >> + * described above. > I'm not sure that's what my understanding of a blocked signal is, I > would interpret "blocked" as a signal being masked (this usage can be > seen in for example sigaction(2)). I'd also interpret delivery of the > signal as happening when the signal handler is invoked rather than > something that the handler has control over (the comment later on says > that so I think it's just an issue here). Perhaps I'm confused about > terminology though, this is just usage I've picked up and ICBW. Isn't "signal being masked" equivalent to what I wrote... man signal(7): Under "Signal mask and pending signals":- "A signal may be blocked, which means that it will not be delivered until it is later unblocked." Under "Signal dispositions":- "Each signal has a current disposition, which determines how the process behaves when it is delivered the signal." The above must imply that, the delivery of a signal implies a signal disposition coming into picture; so in case of blocked signal, the following should happen: Set disposition (default, ignore, or jump to handler) -> block SIG_x using, say, sigprocmask() -> raise(SIG_x) -> nothing happens, do normal work -> unblock SIG_x by sigprocmask() -> immediately act on disposition, since the signal will be delivered. When I wrote "such action may involve termination of the process..." I should have also included "or jump to a signal handler". "The comment later on says that", which comment and what does it say, sorry didn't get you. > >> + * For standard signals (also see real-time signals in the man page), multiple >> + * blocked instances of the same signal are not queued; such a signal will >> + * be delivered just once. > See also SA_NODEFER. Yes, thanks for the note, but do need to include it in the comments? This is a specific setting... > >> + /* SEGV has been blocked in sa_mask, but ucontext is invariant */ >> + ret = sigismember(&(((ucontext_t *)uc)->uc_sigmask), SIGSEGV); >> + ksft_test_result(ret == 0, "SEGV not blocked in ucontext\n"); >> + >> + /* USR1 has been blocked, but ucontext is invariant */ >> + ret = sigismember(&(((ucontext_t *)uc)->uc_sigmask), SIGUSR1); >> + ksft_test_result(ret == 0, "USR1 not blocked in ucontext\n"); > We're not manipulating the masks outside of main() so it's a bit unclear > what the mention of ucontext being invariant is all about here? This is the point I raised in the cover letter and in this program: the mask stores the set of blocked signals. What should happen when I block signals using sigaction()? According to the man pages, one could easily come to an erroneous conclusion that these signals will also be present as blocked in ucontext. I am making a point that, SEGV and USR1 have been blocked, but they have not been added into ucontext, i.e ucontext is invariant w.r.t to before and in the handler. > >> + /* Mangled ucontext implies USR2 is blocked for current thread */ >> + if (raise(SIGUSR2)) >> + ksft_exit_fail_perror("raise"); >> + >> + ksft_print_msg("USR2 bypassed successfully\n"); >> + >> + act.sa_sigaction = &handler_verify_ucontext; >> + if (sigaction(SIGUSR1, &act, NULL)) >> + ksft_exit_fail_perror("Cannot install handler"); >> + >> + if (raise(SIGUSR1)) >> + ksft_exit_fail_perror("raise"); >> + >> + ksft_print_msg("USR2 still blocked on return from handler\n"); > But we just raised SIGUSR1 rather than SIGUSR2? If nothing else this > bit is a little unclear. Before raise(SIGUSR1), we register a handler for it: handler_verify_ucontext. So, we jump there, we verify that USR2 is present in ucontext (since we mangled with ucontext before), then we raise(SIGUSR2): the program must not terminate since USR2 is blocked in ¤t->blocked. This is described by ksft_print_msg().
On 6/12/24 18:46, Mark Brown wrote: > On Wed, Jun 12, 2024 at 10:14:01AM +0530, Dev Jain wrote: >> On 6/11/24 16:55, Mark Brown wrote: >>> On Tue, Jun 11, 2024 at 01:26:50PM +0530, Dev Jain wrote: >>>> + * A signal is said to be delivered, when the program takes action on the >>>> + * signal: such action may involve termination of the process, ignoring the >>>> + * signal, terminating with core dump, stopping the process, or continuing the >>>> + * process if it was currently stopped. A signal is said to be blocked when the >>>> + * program refuses to take any of the above actions; note that, this is not the >>>> + * same as ignoring the signal. At a later time, the program may unblock the >>>> + * signal and then it will have to take one of the five actions >>>> + * described above. >>> I'm not sure that's what my understanding of a blocked signal is, I >>> would interpret "blocked" as a signal being masked (this usage can be >>> seen in for example sigaction(2)). I'd also interpret delivery of the >>> signal as happening when the signal handler is invoked rather than >>> something that the handler has control over (the comment later on says >>> that so I think it's just an issue here). Perhaps I'm confused about >>> terminology though, this is just usage I've picked up and ICBW. >> Isn't "signal being masked" equivalent to what I wrote... >> man signal(7): Under "Signal mask and pending signals":- >> "A signal may be blocked, which means that it will not be delivered >> until it is later unblocked." >> Under "Signal dispositions":- >> "Each signal has a current disposition, which determines how the >> process behaves when it is delivered the signal." > The point is that the delivery and blocking are done prior to the > process getting involved in the handling of the signal, the delivery > happens when the signal handler is invoked. The program requests > delivery or blocking but it doesn't actually do the delivery or blocking > itself. I guess we agree on the same thing; so, how about I rephrase the delivery and blocking code comments this way: "A process can request blocking of a signal by masking it into its set of blocked signals; such a signal, when sent to the process by the kernel, will get blocked by the process and it may later unblock it and take an action. At that point, the signal will be "delivered". A signal sent by the kernel to the process, is said to be delivered to the process when the process takes an action upon receipt of the signal: such action may include termination, or jumping to a signal handler." > >> "The comment later on says that", which comment and what does it say, >> sorry didn't get you. > That signals are blocked before the process sees them. > >>>> + * For standard signals (also see real-time signals in the man page), multiple >>>> + * blocked instances of the same signal are not queued; such a signal will >>>> + * be delivered just once. >>> See also SA_NODEFER. >> Yes, thanks for the note, but do need to include it in the >> comments? This is a specific setting... > TBH I'm not sure what you mean there by real time signals, I can't see > a reference to real time in the copies of signal(2), signal(7) or > sigaction(2) on my system. I suspect SA_NODEFER is the actual thing > here. Real-time signals get a mention on signal(7), under the heading "Real-time signals": "Multiple instances of real-time signals can be queued. By contrast, if multiple instances of a standard signal are delivered while that signal is currently blocked, then only one instance is queued." I guess SA_NODEFER has no relation with queuing; it is used to not block the signal for which the handler was installed. > >>>> + /* SEGV has been blocked in sa_mask, but ucontext is invariant */ >>>> + ret = sigismember(&(((ucontext_t *)uc)->uc_sigmask), SIGSEGV); >>>> + ksft_test_result(ret == 0, "SEGV not blocked in ucontext\n"); >>> We're not manipulating the masks outside of main() so it's a bit unclear >>> what the mention of ucontext being invariant is all about here? >> This is the point I raised in the cover letter and in this program: the mask >> stores the set of blocked signals. What should happen when I block signals >> using sigaction()? According to the man pages, one could easily come to >> an erroneous conclusion that these signals will also be present as blocked >> in ucontext. I am making a point that, SEGV and USR1 have been blocked, >> but they have not been added into ucontext, i.e ucontext is invariant w.r.t >> to before and in the handler. > I still don't follow what the above means. When you say "invariant" you > don't specify with respect to what, and it's not clear to me why the > saved context in ucontext would have changed without the handler writing > to it. For clarity I think this needs to say what the ucontext is > expected to be the same as/different to. The ucontext at this stage is supposed to be empty, I guess I'll replace the word "invariant" then. "it's not clear to me why the saved context in ucontext would have changed without the handler writing to it" - by invariant I meant, the set of blocked signals before invocation of handler is exactly the set of signals blocked in ucontext, which, in this case, is the empty set. I'll just write that ucontext is empty. > > The general flow with signals is that the context at the time the signal > is delivered is saved to the context structure, then the signal handler > context is set up and the signal handler invoked. There are a number of > ways in which the signal handler context may differ from the context > that was interrupted, additional signals being masked is one of those. > On return from the signal handler the context is then restored from > memory and we restart from that context, potentially including > modifications made during handling. This means that the state in the > signal handler may be different to the state in the context that was > preempted by it. > >>>> + act.sa_sigaction = &handler_verify_ucontext; >>>> + if (sigaction(SIGUSR1, &act, NULL)) >>>> + ksft_exit_fail_perror("Cannot install handler"); >>>> + >>>> + if (raise(SIGUSR1)) >>>> + ksft_exit_fail_perror("raise"); >>>> + >>>> + ksft_print_msg("USR2 still blocked on return from handler\n"); >>> But we just raised SIGUSR1 rather than SIGUSR2? If nothing else this >>> bit is a little unclear. >> Before raise(SIGUSR1), we register a handler for it: handler_verify_ucontext. >> So, we jump there, we verify that USR2 is present in ucontext (since we mangled >> with ucontext before), then we raise(SIGUSR2): the program must not terminate >> since USR2 is blocked in ¤t->blocked. This is described by ksft_print_msg(). > Like I say I think this needs a comment, it's not obvious from the > immediate code what the USR1 handler is doing and we're not doing > anything in this context to verify anything about USR2 so it looks like > a missed search/replace. Okay, I'll add a comment.
On Thu, Jun 13, 2024 at 10:21:39AM +0530, Dev Jain wrote: > I guess we agree on the same thing; so, how about I rephrase the delivery > and blocking code comments this way: > "A process can request blocking of a signal by masking it into its set of > blocked signals; such a signal, when sent to the process by the kernel, will > get blocked by the process and it may later unblock it and take an action. > At that point, the signal will be "delivered". Yes. > A signal sent by the kernel to the process, is said to be delivered to the > process when the process takes an action upon receipt of the signal: such > action may include termination, or jumping to a signal handler." I'd just drop this last paragraph. > > TBH I'm not sure what you mean there by real time signals, I can't see > > a reference to real time in the copies of signal(2), signal(7) or > > sigaction(2) on my system. I suspect SA_NODEFER is the actual thing > > here. > Real-time signals get a mention on signal(7), under the heading > "Real-time signals": Ah, it's got a - in there so it doesn't show up in searches. > > I still don't follow what the above means. When you say "invariant" you > > don't specify with respect to what, and it's not clear to me why the > > saved context in ucontext would have changed without the handler writing > > to it. For clarity I think this needs to say what the ucontext is > > expected to be the same as/different to. > The ucontext at this stage is supposed to be empty, I guess I'll replace > the word "invariant" then. > "it's not clear to me why the saved context in ucontext would have changed > without the handler writing to it" - by invariant I meant, the set of blocked > signals before invocation of handler is exactly the set of signals blocked in > ucontext, which, in this case, is the empty set. I'll just write that ucontext > is empty. Yes, or like I say in general it's the the interrupted context (there's other parts of the signal frame which are changed).
diff --git a/tools/testing/selftests/signal/.gitignore b/tools/testing/selftests/signal/.gitignore index 98a7bbc4f325..397fef11c89f 100644 --- a/tools/testing/selftests/signal/.gitignore +++ b/tools/testing/selftests/signal/.gitignore @@ -1,2 +1,3 @@ # SPDX-License-Identifier: GPL-2.0-only +mangle_uc_sigmask sigaltstack diff --git a/tools/testing/selftests/signal/Makefile b/tools/testing/selftests/signal/Makefile index dd6be992fd81..735387a53114 100644 --- a/tools/testing/selftests/signal/Makefile +++ b/tools/testing/selftests/signal/Makefile @@ -1,6 +1,7 @@ # SPDX-License-Identifier: GPL-2.0-only CFLAGS = -Wall -TEST_GEN_PROGS = sigaltstack +TEST_GEN_PROGS = mangle_uc_sigmask +TEST_GEN_PROGS += sigaltstack include ../lib.mk diff --git a/tools/testing/selftests/signal/mangle_uc_sigmask.c b/tools/testing/selftests/signal/mangle_uc_sigmask.c new file mode 100644 index 000000000000..9d4644106465 --- /dev/null +++ b/tools/testing/selftests/signal/mangle_uc_sigmask.c @@ -0,0 +1,194 @@ +// SPDX-License-Identifier: GPL-2.0-only +/* + * Copyright (C) 2024 ARM Ltd. + * + * Author: Dev Jain <dev.jain@arm.com> + * + * Test describing a clear distinction between signal states - delivered and + * blocked, and their relation with ucontext. + * + * A signal is said to be delivered, when the program takes action on the + * signal: such action may involve termination of the process, ignoring the + * signal, terminating with core dump, stopping the process, or continuing the + * process if it was currently stopped. A signal is said to be blocked when the + * program refuses to take any of the above actions; note that, this is not the + * same as ignoring the signal. At a later time, the program may unblock the + * signal and then it will have to take one of the five actions + * described above. + * + * We test the following functionalities of the kernel: + * + * ucontext_t describes the current state of the thread; this implies that, in + * case of registering a handler and catching the corresponding signal, that + * state is before what was jumping into the handler. + * + * The thread's mask of blocked signals can be permanently changed, i.e, not + * just during the execution of the handler, by mangling with uc_sigmask + * from inside the handler. + * + * Assume that we block the set of signals, S1, by sigaction(), and say, the + * signal for which the handler was installed, is S2. When S2 is sent to the + * program, it will be considered "delivered", since we will act on the + * signal and jump to the handler. Any instances of S1 or S2 raised, while the + * program is executing inside the handler, will be blocked; they will be + * delivered immediately upon termination of the handler. + * + * For standard signals (also see real-time signals in the man page), multiple + * blocked instances of the same signal are not queued; such a signal will + * be delivered just once. + */ + +#include <stdio.h> +#include <stdlib.h> +#include <signal.h> +#include <ucontext.h> + +#include "../kselftest.h" + +void handler_verify_ucontext(int signo, siginfo_t *info, void *uc) +{ + int ret; + + /* Kernel dumps ucontext with USR2 blocked */ + ret = sigismember(&(((ucontext_t *)uc)->uc_sigmask), SIGUSR2); + ksft_test_result(ret == 1, "USR2 blocked in ucontext\n"); + + /* + * USR2 is blocked; can be delivered neither here, nor after + * exit from handler + */ + if (raise(SIGUSR2)) + ksft_exit_fail_perror("raise"); +} + +void handler_segv(int signo, siginfo_t *info, void *uc) +{ + /* + * Three cases possible: + * 1. Program already terminated due to segmentation fault. + * 2. SEGV was blocked even after returning from handler_usr. + * 3. SEGV was delivered on returning from handler_usr. + * The last option must happen. + */ + ksft_test_result_pass("SEGV delivered\n"); +} + +static int cnt; + +void handler_usr(int signo, siginfo_t *info, void *uc) +{ + int ret; + + /* + * Break out of infinite recursion caused by raise(SIGUSR1) invoked + * from inside the handler + */ + ++cnt; + if (cnt > 1) + return; + + ksft_print_msg("In handler_usr\n"); + + /* SEGV blocked during handler execution, delivered on return */ + if (raise(SIGSEGV)) + ksft_exit_fail_perror("raise"); + + ksft_print_msg("SEGV bypassed successfully\n"); + + /* + * Signal responsible for handler invocation is blocked by default; + * delivered on return, leading to recursion + */ + if (raise(SIGUSR1)) + ksft_exit_fail_perror("raise"); + + ksft_test_result(cnt == 1, + "USR1 is blocked, cannot invoke handler right now\n"); + + /* Raise USR1 again; only one instance must be delivered upon exit */ + if (raise(SIGUSR1)) + ksft_exit_fail_perror("raise"); + + /* SEGV has been blocked in sa_mask, but ucontext is invariant */ + ret = sigismember(&(((ucontext_t *)uc)->uc_sigmask), SIGSEGV); + ksft_test_result(ret == 0, "SEGV not blocked in ucontext\n"); + + /* USR1 has been blocked, but ucontext is invariant */ + ret = sigismember(&(((ucontext_t *)uc)->uc_sigmask), SIGUSR1); + ksft_test_result(ret == 0, "USR1 not blocked in ucontext\n"); + + /* + * Mangle ucontext; this will be copied back into ¤t->blocked + * on return from the handler. + */ + if (sigaddset(&((ucontext_t *)uc)->uc_sigmask, SIGUSR2)) + ksft_exit_fail_perror("sigaddset"); +} + +int main(int argc, char *argv[]) +{ + struct sigaction act, act2; + sigset_t *set, *oldset; + + ksft_print_header(); + ksft_set_plan(7); + + act.sa_flags = SA_SIGINFO; + act.sa_sigaction = &handler_usr; + + /* Add SEGV to blocked mask */ + if (sigemptyset(&act.sa_mask) || sigaddset(&act.sa_mask, SIGSEGV) + || (sigismember(&act.sa_mask, SIGSEGV) != 1)) + ksft_exit_fail_msg("Cannot add SEGV to blocked mask\n"); + + if (sigaction(SIGUSR1, &act, NULL)) + ksft_exit_fail_perror("Cannot install handler"); + + act2.sa_flags = SA_SIGINFO; + act2.sa_sigaction = &handler_segv; + + if (sigaction(SIGSEGV, &act2, NULL)) + ksft_exit_fail_perror("Cannot install handler"); + + /* Invoke handler */ + if (raise(SIGUSR1)) + ksft_exit_fail_perror("raise"); + + /* USR1 must not be queued */ + ksft_test_result(cnt == 2, "handler invoked only twice\n"); + + /* Mangled ucontext implies USR2 is blocked for current thread */ + if (raise(SIGUSR2)) + ksft_exit_fail_perror("raise"); + + ksft_print_msg("USR2 bypassed successfully\n"); + + act.sa_sigaction = &handler_verify_ucontext; + if (sigaction(SIGUSR1, &act, NULL)) + ksft_exit_fail_perror("Cannot install handler"); + + if (raise(SIGUSR1)) + ksft_exit_fail_perror("raise"); + + ksft_print_msg("USR2 still blocked on return from handler\n"); + + /* Confirm USR2 blockage by sigprocmask() too */ + set = malloc(sizeof(sigset_t *)); + if (!set) + ksft_exit_fail_perror("malloc"); + + oldset = malloc(sizeof(sigset_t *)); + if (!oldset) + ksft_exit_fail_perror("malloc"); + + if (sigemptyset(set)) + ksft_exit_fail_perror("sigemptyset"); + + if (sigprocmask(SIG_BLOCK, set, oldset)) + ksft_exit_fail_perror("sigprocmask"); + + ksft_test_result(sigismember(oldset, SIGUSR2) == 1, + "USR2 present in ¤t->blocked\n"); + + ksft_finished(); +}
This test asserts the relation between blocked signal, delivered signal, and ucontext. The ucontext is mangled with, by adding a signal mask to it; on return from the handler, the thread must block the corresponding signal. In the test description, I have also described what it exactly means for a signal to be delivered or blocked, for ease of clarity. Signed-off-by: Dev Jain <dev.jain@arm.com> --- tools/testing/selftests/signal/.gitignore | 1 + tools/testing/selftests/signal/Makefile | 3 +- .../selftests/signal/mangle_uc_sigmask.c | 194 ++++++++++++++++++ 3 files changed, 197 insertions(+), 1 deletion(-) create mode 100644 tools/testing/selftests/signal/mangle_uc_sigmask.c