1 // Copyright 2018 the V8 project authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file.
4
5 // PLEASE READ BEFORE CHANGING THIS FILE!
6 //
7 // This file implements the out of bounds signal handler for
8 // WebAssembly. Signal handlers are notoriously difficult to get
9 // right, and getting it wrong can lead to security
10 // vulnerabilities. In order to minimize this risk, here are some
11 // rules to follow.
12 //
13 // 1. Do not introduce any new external dependencies. This file needs
14 // to be self contained so it is easy to audit everything that a
15 // signal handler might do.
16 //
17 // 2. Any changes must be reviewed by someone from the crash reporting
18 // or security team. See OWNERS for suggested reviewers.
19 //
20 // For more information, see https://goo.gl/yMeyUY.
21 //
22 // This file contains most of the code that actually runs in a signal handler
23 // context. Some additional code is used both inside and outside the signal
24 // handler. This code can be found in handler-shared.cc.
25
26 #include "src/trap-handler/handler-inside-posix.h"
27
28 #include <signal.h>
29
30 #if defined(V8_OS_LINUX) || defined(V8_OS_FREEBSD)
31 #include <ucontext.h>
32 #elif V8_OS_DARWIN
33 #include <sys/ucontext.h>
34 #endif
35
36 #include <stddef.h>
37 #include <stdlib.h>
38
39 #include "src/trap-handler/trap-handler-internal.h"
40 #include "src/trap-handler/trap-handler.h"
41
42 #ifdef V8_TRAP_HANDLER_VIA_SIMULATOR
43 #include "src/trap-handler/trap-handler-simulator.h"
44 #endif
45
46 namespace v8 {
47 namespace internal {
48 namespace trap_handler {
49
50 #if V8_OS_LINUX
51 #define CONTEXT_REG(reg, REG) &uc->uc_mcontext.gregs[REG_##REG]
52 #elif V8_OS_DARWIN
53 #define CONTEXT_REG(reg, REG) &uc->uc_mcontext->__ss.__##reg
54 #elif V8_OS_FREEBSD
55 #define CONTEXT_REG(reg, REG) &uc->uc_mcontext.mc_##reg
56 #else
57 #error "Unsupported platform."
58 #endif
59
IsKernelGeneratedSignal(siginfo_t * info)60 bool IsKernelGeneratedSignal(siginfo_t* info) {
61 // On macOS, only `info->si_code > 0` is relevant, because macOS leaves
62 // si_code at its default of 0 for signals that don’t originate in hardware.
63 // The other conditions are only relevant for Linux.
64 return info->si_code > 0 && info->si_code != SI_USER &&
65 info->si_code != SI_QUEUE && info->si_code != SI_TIMER &&
66 info->si_code != SI_ASYNCIO && info->si_code != SI_MESGQ;
67 }
68
69 class UnmaskOobSignalScope {
70 public:
UnmaskOobSignalScope()71 UnmaskOobSignalScope() {
72 sigset_t sigs;
73 // Fortunately, sigemptyset and sigaddset are async-signal-safe according to
74 // the POSIX standard.
75 sigemptyset(&sigs);
76 sigaddset(&sigs, kOobSignal);
77 pthread_sigmask(SIG_UNBLOCK, &sigs, &old_mask_);
78 }
79
80 UnmaskOobSignalScope(const UnmaskOobSignalScope&) = delete;
81 void operator=(const UnmaskOobSignalScope&) = delete;
82
~UnmaskOobSignalScope()83 ~UnmaskOobSignalScope() { pthread_sigmask(SIG_SETMASK, &old_mask_, nullptr); }
84
85 private:
86 sigset_t old_mask_;
87 };
88
89 #ifdef V8_TRAP_HANDLER_VIA_SIMULATOR
90 // This is the address where we continue on a failed "ProbeMemory". It's defined
91 // in "handler-outside-simulator.cc".
92 extern "C" char v8_probe_memory_continuation[];
93 #endif // V8_TRAP_HANDLER_VIA_SIMULATOR
94
TryHandleSignal(int signum,siginfo_t * info,void * context)95 bool TryHandleSignal(int signum, siginfo_t* info, void* context) {
96 // Ensure the faulting thread was actually running Wasm code. This should be
97 // the first check in the trap handler to guarantee that the
98 // g_thread_in_wasm_code flag is only set in wasm code. Otherwise a later
99 // signal handler is executed with the flag set.
100 if (!g_thread_in_wasm_code) return false;
101
102 // Clear g_thread_in_wasm_code, primarily to protect against nested faults.
103 // The only path that resets the flag to true is if we find a landing pad (in
104 // which case this function returns true). Otherwise we leave the flag unset
105 // since we do not return to wasm code.
106 g_thread_in_wasm_code = false;
107
108 // Bail out early in case we got called for the wrong kind of signal.
109 if (signum != kOobSignal) return false;
110
111 // Make sure the signal was generated by the kernel and not some other source.
112 if (!IsKernelGeneratedSignal(info)) return false;
113
114 // Unmask the oob signal, which is automatically masked during the execution
115 // of this handler. This ensures that crashes generated in this function will
116 // be handled by the crash reporter. Otherwise, the process might be killed
117 // with the crash going unreported. The scope object makes sure to restore the
118 // signal mask on return from this function. We put the scope object in a
119 // separate block to ensure that we restore the signal mask before we restore
120 // the g_thread_in_wasm_code flag.
121 {
122 UnmaskOobSignalScope unmask_oob_signal;
123
124 ucontext_t* uc = reinterpret_cast<ucontext_t*>(context);
125 #if V8_HOST_ARCH_X64
126 auto* context_ip = CONTEXT_REG(rip, RIP);
127 #elif V8_HOST_ARCH_ARM64
128 auto* context_ip = CONTEXT_REG(pc, PC);
129 #else
130 #error "Unsupported architecture."
131 #endif
132
133 uintptr_t fault_addr = *context_ip;
134 uintptr_t landing_pad = 0;
135
136 #ifdef V8_TRAP_HANDLER_VIA_SIMULATOR
137 // Only handle signals triggered by the load in {ProbeMemory}.
138 if (fault_addr != reinterpret_cast<uintptr_t>(&ProbeMemory)) {
139 return false;
140 }
141
142 // The simulated ip will be in the second parameter register (%rsi).
143 auto* simulated_ip_reg = CONTEXT_REG(rsi, RSI);
144 if (!TryFindLandingPad(*simulated_ip_reg, &landing_pad)) return false;
145 TH_DCHECK(landing_pad != 0);
146
147 auto* return_reg = CONTEXT_REG(rax, RAX);
148 *return_reg = landing_pad;
149 // Continue at the memory probing continuation.
150 *context_ip = reinterpret_cast<uintptr_t>(&v8_probe_memory_continuation);
151 #else
152 if (!TryFindLandingPad(fault_addr, &landing_pad)) return false;
153
154 // Tell the caller to return to the landing pad.
155 *context_ip = landing_pad;
156 #endif
157 }
158 // We will return to wasm code, so restore the g_thread_in_wasm_code flag.
159 // This should only be done once the signal is blocked again (outside the
160 // {UnmaskOobSignalScope}) to ensure that we do not catch a signal we raise
161 // inside of the handler.
162 g_thread_in_wasm_code = true;
163 return true;
164 }
165
HandleSignal(int signum,siginfo_t * info,void * context)166 void HandleSignal(int signum, siginfo_t* info, void* context) {
167 if (!TryHandleSignal(signum, info, context)) {
168 // Since V8 didn't handle this signal, we want to re-raise the same signal.
169 // For kernel-generated signals, we do this by restoring the original
170 // handler and then returning. The fault will happen again and the usual
171 // signal handling will happen.
172 //
173 // We handle user-generated signals by calling raise() instead. This is for
174 // completeness. We should never actually see one of these, but just in
175 // case, we do the right thing.
176 RemoveTrapHandler();
177 if (!IsKernelGeneratedSignal(info)) {
178 raise(signum);
179 }
180 }
181 // TryHandleSignal modifies context to change where we return to.
182 }
183
184 } // namespace trap_handler
185 } // namespace internal
186 } // namespace v8
187