NetBSD Problem Report #58683

From www@netbsd.org  Fri Sep 20 16:41:46 2024
Return-Path: <www@netbsd.org>
Received: from mail.netbsd.org (mail.netbsd.org [199.233.217.200])
	(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
	 key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256
	 client-signature RSA-PSS (2048 bits) client-digest SHA256)
	(Client CN "mail.NetBSD.org", Issuer "mail.NetBSD.org CA" (not verified))
	by mollari.NetBSD.org (Postfix) with ESMTPS id 68EDF1A923D
	for <gnats-bugs@gnats.NetBSD.org>; Fri, 20 Sep 2024 16:41:46 +0000 (UTC)
Message-Id: <20240920164145.4F7041A923E@mollari.NetBSD.org>
Date: Fri, 20 Sep 2024 16:41:45 +0000 (UTC)
From: cryintothebluesky@gmail.com
Reply-To: cryintothebluesky@gmail.com
To: gnats-bugs@NetBSD.org
Subject: pthread_setaffinity_np() results on SIGSEGV on aarch64
X-Send-Pr-Version: www-1.0

>Number:         58683
>Category:       port-evbarm
>Synopsis:       pthread_setaffinity_np() results on SIGSEGV on aarch64
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    port-evbarm-maintainer
>State:          closed
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Fri Sep 20 16:45:01 +0000 2024
>Closed-Date:    Sat Sep 21 07:42:25 +0000 2024
>Last-Modified:  Sat Sep 21 07:42:25 +0000 2024
>Originator:     Sad Clouds
>Release:        10.0_STABLE
>Organization:
>Environment:
>Description:
Check if user_set_cpu_affinity is disabled:
# sysctl security.models.extensions.user_set_cpu_affinity
security.models.extensions.user_set_cpu_affinity = 0

Run some program which calls pthread_setaffinity_np() as unprivileged user:
$ ./a.out
...
$ gdb ...
Program terminated with signal SIGSEGV, Segmentation fault.
#0  0x0000ffffeed77f30 in _rtld_symlook_obj () from /usr/libexec/ld.elf_so
[Current thread is 1 (process 3112)]
(gdb) bt
#0  0x0000ffffeed77f30 in _rtld_symlook_obj () from /usr/libexec/ld.elf_so
#1  0x0000ffffeed784e4 in _rtld_symlook_list () from /usr/libexec/ld.elf_so
#2  0x0000ffffeed78938 in _rtld_symlook_default () from /usr/libexec/ld.elf_so
#3  0x0000ffffeed78d98 in _rtld_find_plt_symdef () from /usr/libexec/ld.elf_so
#4  0x0000ffffeed71350 in _rtld_bind () from /usr/libexec/ld.elf_so
#5  0x0000ffffeed70b5c in _rtld_bind_start () from /usr/libexec/ld.elf_so
Backtrace stopped: previous frame identical to this frame (corrupt stack?)

If I add this line to /etc/sysctl.conf and reboot:
security.models.extensions.user_set_cpu_affinity=1

Then all is good, but that's not the issue. Unprivileged user should get EPERM error from the function call, not SIGSEGV.
>How-To-Repeat:

>Fix:

>Release-Note:

>Audit-Trail:
From: mlelstv@serpens.de (Michael van Elst)
To: gnats-bugs@netbsd.org
Cc: 
Subject: Re: port-evbarm/58683: pthread_setaffinity_np() results on SIGSEGV on aarch64
Date: Fri, 20 Sep 2024 20:04:00 -0000 (UTC)

 cryintothebluesky@gmail.com writes:

 >Run some program which calls pthread_setaffinity_np() as unprivileged user:
 >$ ./a.out
 >...

 % cat c.c
 #include <pthread.h>
 #include <sched.h>
 #include <stdio.h>
 #include <err.h>

 int main(int argc, char *argv[])
 {
         cpuset_t *c;
         int error;

         c = cpuset_create();
         if (c == NULL)
                 err(1, "cpuset_create");

         cpuset_set(0, c);

         error = pthread_setaffinity_np(pthread_self(), cpuset_size(c), c);
         if (error)
                 err(1, "pthread_setaffinity_np");

         return 0;
 }

 % cc -pthread c.c
 % ./a.out
 a.out: pthread_setaffinity_np: Operation not permitted

 Seems to work.

State-Changed-From-To: open->feedback
State-Changed-By: skrll@NetBSD.org
State-Changed-When: Sat, 21 Sep 2024 06:41:54 +0000
State-Changed-Why:
Michael's test program also works for me. Can you provide a reproducer?


From: Sad Clouds <cryintothebluesky@gmail.com>
To: gnats-bugs@netbsd.org
Cc: skrll@NetBSD.org, port-evbarm-maintainer@netbsd.org,
 netbsd-bugs@netbsd.org, gnats-admin@netbsd.org
Subject: Re: port-evbarm/58683 (pthread_setaffinity_np() results on SIGSEGV
 on aarch64)
Date: Sat, 21 Sep 2024 08:35:44 +0100

 It was a bit late last night, so decided to delay a small test program
 till next day, as the original code is quite big.

 Looks like it has nothing to do with pthread_setaffinity_np(). I
 stepped through the function calls and it was crashing in the error
 handling function, just after pthread_setaffinity_np().

 Each thread adjusts its stack size, as the default is way too big.
 NetBSD on aarch64 returns 4K from sysconf(_SC_THREAD_STACK_MIN), where
 Linux on aarch64 returns 128K.

 The stack size on NetBSD is then adjusted from 4K to 8K, as twice the
 minimum size of _SC_THREAD_STACK_MIN was deemed to be sufficient.

 However, during error handling function, which calls va_start() and
 va_end(), segfault is received due to insufficient stack space.

 Please close this bug as invalid.

State-Changed-From-To: feedback->closed
State-Changed-By: wiz@NetBSD.org
State-Changed-When: Sat, 21 Sep 2024 07:42:25 +0000
State-Changed-Why:
Problem in the test program. Thanks for the explanation!


>Unformatted:

Home	PR Database Search