about summary refs log tree commit diff
path: root/sysdeps/mach/hurd/not-cancel.h
Commit message (Collapse)AuthorAgeFilesLines
* Make __getrandom_nocancel set errno and add a _nostatus versionXi Ruoyao2024-01-121-1/+6
| | | | | | | | | | | | | | | | The __getrandom_nocancel function returns errors as negative values instead of errno. This is inconsistent with other _nocancel functions and it breaks "TEMP_FAILURE_RETRY (__getrandom_nocancel (p, n, 0))" in __arc4random_buf. Use INLINE_SYSCALL_CALL instead of INTERNAL_SYSCALL_CALL to fix this issue. But __getrandom_nocancel has been avoiding from touching errno for a reason, see BZ 29624. So add a __getrandom_nocancel_nostatus function and use it in tcache_key_initialize. Signed-off-by: Xi Ruoyao <xry111@xry111.site> Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org> Signed-off-by: Andreas K. Hüttel <dilfridge@gentoo.org>
* Update copyright dates with scripts/update-copyrightsPaul Eggert2024-01-011-1/+1
|
* Update copyright dates with scripts/update-copyrightsJoseph Myers2023-01-061-1/+1
|
* malloc: Do not clobber errno on __getrandom_nocancel (BZ #29624)Adhemerval Zanella2022-09-301-2/+10
| | | | | | | | | | Use INTERNAL_SYSCALL_CALL instead of INLINE_SYSCALL_CALL. This requires emulate the semantic for hurd call (so __arc4random_buf uses the fallback). Checked on x86_64-linux-gnu. Reviewed-by: Wilco Dijkstra <Wilco.Dijkstra@arm.com>
* arc4random: simplify design for better safetyJason A. Donenfeld2022-07-271-0/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Rather than buffering 16 MiB of entropy in userspace (by way of chacha20), simply call getrandom() every time. This approach is doubtlessly slower, for now, but trying to prematurely optimize arc4random appears to be leading toward all sorts of nasty properties and gotchas. Instead, this patch takes a much more conservative approach. The interface is added as a basic loop wrapper around getrandom(), and then later, the kernel and libc together can work together on optimizing that. This prevents numerous issues in which userspace is unaware of when it really must throw away its buffer, since we avoid buffering all together. Future improvements may include userspace learning more from the kernel about when to do that, which might make these sorts of chacha20-based optimizations more possible. The current heuristic of 16 MiB is meaningless garbage that doesn't correspond to anything the kernel might know about. So for now, let's just do something conservative that we know is correct and won't lead to cryptographic issues for users of this function. This patch might be considered along the lines of, "optimization is the root of all evil," in that the much more complex implementation it replaces moves too fast without considering security implications, whereas the incremental approach done here is a much safer way of going about things. Once this lands, we can take our time in optimizing this properly using new interplay between the kernel and userspace. getrandom(0) is used, since that's the one that ensures the bytes returned are cryptographically secure. But on systems without it, we fallback to using /dev/urandom. This is unfortunate because it means opening a file descriptor, but there's not much of a choice. Secondly, as part of the fallback, in order to get more or less the same properties of getrandom(0), we poll on /dev/random, and if the poll succeeds at least once, then we assume the RNG is initialized. This is a rough approximation, as the ancient "non-blocking pool" initialized after the "blocking pool", not before, and it may not port back to all ancient kernels, though it does to all kernels supported by glibc (≥3.2), so generally it's the best approximation we can do. The motivation for including arc4random, in the first place, is to have source-level compatibility with existing code. That means this patch doesn't attempt to litigate the interface itself. It does, however, choose a conservative approach for implementing it. Cc: Adhemerval Zanella Netto <adhemerval.zanella@linaro.org> Cc: Florian Weimer <fweimer@redhat.com> Cc: Cristian Rodríguez <crrodriguez@opensuse.org> Cc: Paul Eggert <eggert@cs.ucla.edu> Cc: Mark Harris <mark.hsj@gmail.com> Cc: Eric Biggers <ebiggers@kernel.org> Cc: linux-crypto@vger.kernel.org Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com> Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
* stdlib: Add arc4random, arc4random_buf, and arc4random_uniform (BZ #4417)Adhemerval Zanella Netto2022-07-221-0/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The implementation is based on scalar Chacha20 with per-thread cache. It uses getrandom or /dev/urandom as fallback to get the initial entropy, and reseeds the internal state on every 16MB of consumed buffer. To improve performance and lower memory consumption the per-thread cache is allocated lazily on first arc4random functions call, and if the memory allocation fails getentropy or /dev/urandom is used as fallback. The cache is also cleared on thread exit iff it was initialized (so if arc4random is not called it is not touched). Although it is lock-free, arc4random is still not async-signal-safe (the per thread state is not updated atomically). The ChaCha20 implementation is based on RFC8439 [1], omitting the final XOR of the keystream with the plaintext because the plaintext is a stream of zeros. This strategy is similar to what OpenBSD arc4random does. The arc4random_uniform is based on previous work by Florian Weimer, where the algorithm is based on Jérémie Lumbroso paper Optimal Discrete Uniform Generation from Coin Flips, and Applications (2013) [2], who credits Donald E. Knuth and Andrew C. Yao, The complexity of nonuniform random number generation (1976), for solving the general case. The main advantage of this method is the that the unit of randomness is not the uniform random variable (uint32_t), but a random bit. It optimizes the internal buffer sampling by initially consuming a 32-bit random variable and then sampling byte per byte. Depending of the upper bound requested, it might lead to better CPU utilization. Checked on x86_64-linux-gnu, aarch64-linux, and powerpc64le-linux-gnu. Co-authored-by: Florian Weimer <fweimer@redhat.com> Reviewed-by: Yann Droneaud <ydroneaud@opteya.com> [1] https://datatracker.ietf.org/doc/html/rfc8439 [2] https://arxiv.org/pdf/1304.1916.pdf
* Update copyright dates with scripts/update-copyrightsPaul Eggert2022-01-011-1/+1
| | | | | | | | | | | | | | | | | | | | | | | I used these shell commands: ../glibc/scripts/update-copyrights $PWD/../gnulib/build-aux/update-copyright (cd ../glibc && git commit -am"[this commit message]") and then ignored the output, which consisted lines saying "FOO: warning: copyright statement not found" for each of 7061 files FOO. I then removed trailing white space from math/tgmath.h, support/tst-support-open-dev-null-range.c, and sysdeps/x86_64/multiarch/strlen-vec.S, to work around the following obscure pre-commit check failure diagnostics from Savannah. I don't know why I run into these diagnostics whereas others evidently do not. remote: *** 912-#endif remote: *** 913: remote: *** 914- remote: *** error: lines with trailing whitespace found ... remote: *** error: sysdeps/unix/sysv/linux/statx_cp.c: trailing lines
* Remove "Contributed by" linesSiddhesh Poyarekar2021-09-031-1/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | We stopped adding "Contributed by" or similar lines in sources in 2012 in favour of git logs and keeping the Contributors section of the glibc manual up to date. Removing these lines makes the license header a bit more consistent across files and also removes the possibility of error in attribution when license blocks or files are copied across since the contributed-by lines don't actually reflect reality in those cases. Move all "Contributed by" and similar lines (Written by, Test by, etc.) into a new file CONTRIBUTED-BY to retain record of these contributions. These contributors are also mentioned in manual/contrib.texi, so we just maintain this additional record as a courtesy to the earlier developers. The following scripts were used to filter a list of files to edit in place and to clean up the CONTRIBUTED-BY file respectively. These were not added to the glibc sources because they're not expected to be of any use in future given that this is a one time task: https://gist.github.com/siddhesh/b5ecac94eabfd72ed2916d6d8157e7dc https://gist.github.com/siddhesh/15ea1f5e435ace9774f485030695ee02 Reviewed-by: Carlos O'Donell <carlos@redhat.com>
* Update copyright dates with scripts/update-copyrightsPaul Eggert2021-01-021-1/+1
| | | | | | | | | | | | | | | | I used these shell commands: ../glibc/scripts/update-copyrights $PWD/../gnulib/build-aux/update-copyright (cd ../glibc && git commit -am"[this commit message]") and then ignored the output, which consisted lines saying "FOO: warning: copyright statement not found" for each of 6694 files FOO. I then removed trailing white space from benchtests/bench-pthread-locks.c and iconvdata/tst-iconv-big5-hkscs-to-2ucs4.c, to work around this diagnostic from Savannah: remote: *** pre-commit check failed ... remote: *** error: lines with trailing whitespace found remote: error: hook declined to update refs/heads/master
* hurd: Make fcntl(F_SETLKW*) cancellation pointsSamuel Thibault2020-06-281-3/+6
| | | | | | | | | | | | | and add _nocancel variant. * sysdeps/mach/hurd/Makefile [io] (sysdep_routines): Add fcntl_nocancel. * sysdeps/mach/hurd/fcntl.c [NOCANCEL]: Include <not-cancel.h>. [!NOCANCEL]: Include <sysdep-cancel.h>. (__libc_fcntl) [!NOCANCEL]: Surround __file_record_lock call with enabling async cancel, and use HURD_FD_PORT_USE_CANCEL instead of HURD_FD_PORT_USE. * sysdeps/mach/hurd/fcntl_nocancel.c: New file, defines __fcntl_nocancel by including fcntl.c. * sysdeps/mach/hurd/not-cancel.h (__fcntl64_nocancel): Replace macro with __fcntl_nocancel declaration with hidden proto, and make __fcntl64_nocancel call __fcntl_nocancel.
* hurd: make wait4 a cancellation pointSamuel Thibault2020-06-281-2/+7
| | | | | | | | | | | | | | and add _nocancel variant. * sysdeps/mach/hurd/Makefile [io] (sysdep_routines): Add wait4_nocancel. * sysdeps/mach/hurd/wait4.c: Include <sysdep-cancel.h> (__wait4): Surround __proc_wait with enabling async cancel, and use __USEPORT_CANCEL instead of __USEPORT. * sysdeps/mach/hurd/wait4_nocancel.c: New file, contains previous implementation of __wait4. * sysdeps/mach/hurd/not-cancel.h (__waitpid_nocancel): Replace macro with __wait4_nocancel declaration with hidden proto, and make __waitpid_nocancel call __wait4_nocancel.
* hurd: make close a cancellation pointSamuel Thibault2020-06-281-4/+5
| | | | | | | | | | | | | | and add _nocancel variant. * sysdeps/mach/hurd/Makefile [io] (sysdep_routines): Add close_nocancel. * sysdeps/mach/hurd/Versions (libc.GLIBC_PRIVATE, ld.GLIBC_PRIVATE): Add __close_nocancel. * sysdeps/mach/hurd/i386/localplt.data (__close_nocancel): Allow PLT. * sysdeps/mach/hurd/close.c: Include <sysdep-cancel.h> (__libc_close): Surround _hurd_fd_close with enabling async cancel. * sysdeps/mach/hurd/close_nocancel.c: New file. * sysdeps/mach/hurd/not-cancel.h (__close_nocancel): Replace macro with declaration with hidden proto.
* hurd: make open and openat cancellation pointsSamuel Thibault2020-06-281-8/+14
| | | | | | | | | | | | | | | | | | | | | and add _nocancel variants. * sysdeps/mach/hurd/Makefile [io] (sysdep_routines): Add open_nocancel openat_nocancel. * sysdeps/mach/hurd/Versions (libc.GLIBC_PRIVATE, ld.GLIBC_PRIVATE): Add __open_nocancel. * sysdeps/mach/hurd/dl-sysdep.c (__open_nocancel): Add alias, check it is not hidden. * sysdeps/mach/hurd/i386/localplt.data (__open_nocancel): Allow PLT. * sysdeps/mach/hurd/not-cancel.h (__open_nocancel, __openat_nocancel: Replace macros with declarations with hidden proto. (__open64_nocancel, __openat64_nocancel): Call __open_nocancel and __openat_nocancel instead of __open64 and __openat64. * sysdeps/mach/hurd/open.c: Include <sysdep-cancel.h> (__libc_open): Surround __file_name_lookup with enabling async cancel. * sysdeps/mach/hurd/openat.c: Likewise. * sysdeps/mach/hurd/open_nocancel.c, sysdeps/mach/hurd/openat_nocancel.c: New files.
* hurd: Fix __writev_nocancel_nostatusSamuel Thibault2020-06-141-2/+8
| | | | | | | | | | | | | * sysdeps/mach/hurd/Makefile [subdir=misc] (sysdep_routines): Add writev_nocancel writev_nocancel_nostatus. * sysdeps/mach/hurd/not-cancel.h (__writev_nocancel_nostatus): Replace macro with function declaration (with hidden prototype in libc). (__writev_nocancel): New function declaration (with hidden prototype in libc). * sysdeps/mach/hurd/writev_nocancel_nostatus.c: New file. * sysdeps/posix/writev_nocancel.c: New file, includes writev.c to make a nocancel variant that calls __write_nocancel. * sysdeps/posix/writev.c (writev): Do not define alias if __writev is renamed.
* hurd: Make write and pwrite64 cancellation pointsSamuel Thibault2020-06-141-2/+8
| | | | | | | | | | | | | | | | | | | | | | | | | and add _nocancel variants. * sysdeps/mach/hurd/write.c (__libc_write): Call __write_nocancel surrounded by enabling async cancel, to replace implementation moved to... * sysdeps/mach/hurd/write_nocancel.c (__write_nocancel): ... here. * sysdeps/mach/hurd/pwrite64.c (__libc_pwrite64): Call __pwrite64_nocancel surrounded by enabling async cancel, to replace implementation moved to... * sysdeps/mach/hurd/pwrite64_nocancel.c (__pwrite64_nocancel): ... here. * sysdeps/mach/hurd/Makefile (sysdep_routines): Add write_nocancel and pwrite64_nocancel. * sysdeps/mach/hurd/not-cancel.h (__write_nocancel, __pwrite64_nocancel): Replace macros with prototypes with a hidden proto on libc. * sysdeps/mach/hurd/dl-sysdep.c (__write_nocancel): New alias, check that it is not hidden. * sysdeps/mach/hurd/Versions (libc.GLIBC_PRIVATE): Add __write_nocancel. (ld.GLIBC_PRIVATE): Add __write_nocancel. * sysdeps/mach/hurd/i386/localplt.data (__write_nocancel): Add reference.
* hurd: Make read and pread64 cancellableSamuel Thibault2020-06-071-5/+9
| | | | | | | | | | | | | | | | | | | | | | | | | | | and add _nocancel variants. * sysdeps/mach/hurd/pread64.c (__libc_pread64): Call __pread64_nocancel surrounded by enabling async cancel, to replace implementation moved to... * sysdeps/mach/hurd/pread64_nocancel.c (__pread64_nocancel): ... here. * sysdeps/mach/hurd/read.c (__libc_read): Call __read_nocancel surrounded by enabling async cancel, to replace implementation moved to... * sysdeps/mach/hurd/read_nocancel.c (__read_nocancel): ... here. * sysdeps/mach/hurd/Makefile (sysdep_routines): Add read_nocancel and pread64_nocancel. * sysdeps/mach/hurd/not-cancel.h (__read_nocancel, __pread64_nocancel): Replace macros with prototypes with a hidden proto on libc. * sysdeps/mach/hurd/dl-sysdep.c: Include <not-cancel.h>. (__pread64_nocancel): New alias, check that it is not hidden. (__read_nocancel): New alias, check that it is not hidden. * sysdeps/mach/hurd/Versions (libc.GLIBC_PRIVATE): Add __read_nocancel and __pread64_nocancel. (ld.GLIBC_2.1): Add __pread64. (ld.GLIBC_PRIVATE): Add __read_nocancel and __pread64_nocancel. * sysdeps/mach/hurd/i386/ld.abilist (__pread64): Add symbol. * sysdeps/mach/hurd/i386/localplt.data (__read_nocancel, __pread64, __pread64_nocancel): Add references.
* Update copyright dates with scripts/update-copyrights.Joseph Myers2020-01-011-1/+1
|
* hurd: Fix __close_nocancel_nostatus availabilitySamuel Thibault2019-12-131-5/+5
| | | | | | | | | | | | | | Not only libc/rtld use __close_nocancel_nostatus. * sysdeps/mach/hurd/Makefile [$(subdir) == io] (sysdep_routines): Add close_nocancel_nostatus. * sysdeps/mach/hurd/Versions (libc): Add __close_nocancel_nostatus to GLIBC_PRIVATE. * sysdeps/mach/hurd/not-cancel.h (__close_nocancel_nostatus): Declare function instead of defining inline. [IS_IN (libc) || IS_IN (rtld)] (__close_nocancel_nostatus): Make function hidden. * sysdeps/mach/hurd/close_nocancel_nostatus.c: New file.
* hurd: Implement __close_nocancel_nostatusSamuel Thibault2019-12-131-0/+62
* sysdeps/mach/hurd/not-cancel.h: New file.