During initialization, LibOS parses the LD_PRELOAD environment variable
and allocates memory to store its entries. On error, this allocated
memory must be freed. This commit correctly frees memory on error.
MAX_FDS is defined as 3, fds[MAX_FDS] is a 3-element array.
While i in for loop looping from 0 to MAX_FDS, will cause out-of-boundry read for generaic.fds which is a 2-element array.
The generic.fds defiend in pal_host.h should be correctly sized to match with both fds[MAX_FDS] and accommodate for the for loop.
Also fixed another out-of-boundary access for pipeprv
Fixes the following bugs:
* sched_getaffinity(2) should return # of bytes, not bits.
* It should honor `len` argument.
* Linux sched_getaffinity() aligns the result to sizeof(long).
Some Linux applications get the number of CPU cores by querying
/proc/cpuinfo. Before, such apps would be confused by a wrong
format of /proc/cpuinfo in Graphene. This commit updates format
to exactly the same as in Linux kernel.
This commit also adds a LibOS regression test for /proc/cpuinfo.
glibc: remove unnecessary pushq/popq so that shim_clone can run without segv.
This is a preparation for later patch to clean up shim_clone() to
remove glibc modification.
libos: Currently child thread ret ip is taken from new child stack.
But it can be retrieved from parent's thread context, so such a hack
isn't needed.
Now the modification to clone.S is not needed anymore. So remove it.
This code path is called when the urts EENTERs to allow us to prepare
the SSA for the following ERESUME (i.e. inject the exception handler).
It is not for the ERESUME itself. So rename it to avoid confusion.
The comment about the register content is only true for EENTER. Also
usually* this code is reached only by EENTER. ERESUME restores the saved
state from the SSA.
*: It is reached if an async exit happens just after EENTER.
Also remove redundant comments directly below.
This commit ensures that TCS.CSSA == 1 while entering enclave
execution to handle a signal from host OS (recall that CSSA == 0 is for
normal enclave execution and CSSA == 1 is for signal-handling
enclave preparation). This effectively disallows nested signal handling
from a malicious OS. Disallowing nested signals simplifies our code.
Benign OS is prevented from nesting by blocking async signals during
signal handling.
Note that currently enclaves are always run with TCS.NSSA == 2, and SGX
hardware will disallow entering the enclave if TCS.CSSA > 1. Thus, this
commit serves as an assertion in case NSSA limit is changed in future.
Before, connect() host-OS syscall was issued unconditionally in
sgx_ocall_sock_connect(). However, UDP clients do not strictly need to
issue connect() before sending packets to UDP server. In this case, addr
is NULL, and sgx_ocall_sock_connect() must not issue connect().
See #389.
Per the manpage, POLLERR and POLLUP are returned in `revents` and
ignored in `events`. Indeed, programs should not be setting, and
typically don't set -- `events` with these values.
The effect of this bug is, among others, that a process will never get a
disconnect event from a peer socket.
- Time-Of-Check-To-Time-Of-Use (TOCTOU) vulnerability is closed
by first copying untrusted values inside enclave and then
operating on these copied values; see sgx_copy_to_enclave().
- Pointer/integer overflow is closed by comparing against a
trusted maximum value in sgx_copy_to_enclave().
- Untrusted stack overflows in sgx_alloc_on_ustack()/sgx_copy_to_ustack()
are closed by checking for NULL return values.
These vulnerabilities were independently discovered and disclosed
by David Oswald, Jo van Bulck, and others.
Instead we use the fact that the manifest is always placed at the top of
the enclave address range. The manifest size is stored inside the TLS
like we have already done for the enclave size.
Part of issue #509.
Before, pause() was emulated by sleeping for 1s in a loop until
signal interrupted it. If signal arrived in-between these invocations
then pause() could never return. Also, pause() incorrectly returned 0
instead of -1 and errno=EINTR.
This patch emulates pause() by sleeping for a very long time (years).
Also, it correctly returns EINTR.
On weaker machines (Intel NUCs and SGX-enabled laptops),
SGX regression tests take longer than 5 seconds because
Graphene measures/zeroes all enclave memory at startup.
Increase the timeout for SGX regression tests to 20 sec.
Before this change some important memory areas, for example TCS and TLS
were not measured. With this change all mapped enclave memory is
measured with one exception. Since the EEXTEND hashing is rather slow
the heap is not measured. Instead it gets zeroed on enclave startup.
Closes#505.
Dmitrii Kuvaiskii