From nobody Fri Apr 3 07:54:12 2026 Received: from smtpout.efficios.com (smtpout.efficios.com [158.69.130.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id BBE892FE07D for ; Fri, 20 Feb 2026 20:06:52 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=158.69.130.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1771618014; cv=none; b=Cndi6NL02o16HiFKzD04jG0dS+9uhc8xgfQeoiUPX3SUSOeh11IV8mS8LvF26dtQBvDOZC9Ss+p5eAecv2G+BlSfXcGjYk5AilHYtjh4cSJMj7fpyDEDY+et8tuOt+j5GHM+J0qiLp7jR/uIutZuMruPWy6CaMX3WGNUCtIkz0Q= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1771618014; c=relaxed/simple; bh=L1wLMHI0oI0LjxHlc2YwsZo354xzGirQ7xFxSyvfON0=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=nQhj5jJDSXj7ieut5gXL1atfAX/DcAF1YRVGAilC2xu7Ws8V+JOu6/nKWViML0zTpI8uvf3ab4C64jHC5140cOvrfMyizNqXrNbRmuIOa1SLNoAy3MsvMRhGQbzyFYBaJFZXCaqdWVFg0w6Ywuk5iXCT+nfpaDH7EimgS1GKmmo= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=efficios.com; spf=pass smtp.mailfrom=efficios.com; dkim=pass (2048-bit key) header.d=efficios.com header.i=@efficios.com header.b=U0yZ/+OQ; arc=none smtp.client-ip=158.69.130.18 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=efficios.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=efficios.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=efficios.com header.i=@efficios.com header.b="U0yZ/+OQ" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=efficios.com; s=smtpout1; t=1771618006; bh=NnvSvLNsHWWpbpKQkIRk4qePKv6sL5zIgZ0CeBrrNOg=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=U0yZ/+OQ7HsUrnmI7pNBwaL0ro+tWENjq2W8g1otJf4kWeG4EPjIV0q7hWUaEgqCE XeSBFsnSIe0uU0/oIDRxShc9cYy47BywkVZsiMF3lV3Nofb/ENmAfpUW/uwUVCXljc TncgCEs/o3vqYQAmi5FM3fK3TJJvzGD9jg3/KcfkriSBGFzHOLyzptSymCjz7BbE2N gRabUXcSBypLVky4l8eC6NOpwtE4AlNtqj6oiiqkl3bdMablnF8j/6NCJCOqTUVVQE L/m+uzwuJ4eg/rodNg2FZxUJ/naIKyMPH0COvR+MhJaNGAtQLG+GCBJODtyoh6tJAo 7W+zVNSgwZCbA== Received: from thinkos.internal.efficios.com (mtl.efficios.com [216.120.195.104]) by smtpout.efficios.com (Postfix) with ESMTPSA id 4fHh923qw3zGrH; Fri, 20 Feb 2026 15:06:46 -0500 (EST) From: Mathieu Desnoyers To: Peter Zijlstra Cc: linux-kernel@vger.kernel.org, Mathieu Desnoyers , Ingo Molnar , Thomas Gleixner , Carlos O'Donell , Florian Weimer , Michael Jeanson Subject: [PATCH v3 1/2] rseq: Clarify rseq registration rseq_size bound check comment Date: Fri, 20 Feb 2026 15:06:40 -0500 Message-Id: <20260220200642.1317826-2-mathieu.desnoyers@efficios.com> X-Mailer: git-send-email 2.39.5 In-Reply-To: <20260220200642.1317826-1-mathieu.desnoyers@efficios.com> References: <20260220200642.1317826-1-mathieu.desnoyers@efficios.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" The rseq registration validates that the rseq_size argument is greater or equal to 32 (the original rseq size), but the comment associated with this check does not clearly state this. Clarify the comment to that effect. Fixes: ee3e3ac05c26 ("rseq: Introduce extensible rseq ABI") Signed-off-by: Mathieu Desnoyers CC: Peter Zijlstra (Intel) CC: Ingo Molnar CC: Thomas Gleixner --- kernel/rseq.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/kernel/rseq.c b/kernel/rseq.c index b0973d19f366..e349f86cc945 100644 --- a/kernel/rseq.c +++ b/kernel/rseq.c @@ -449,8 +449,9 @@ SYSCALL_DEFINE4(rseq, struct rseq __user *, rseq, u32, = rseq_len, int, flags, u32 * auxiliary vector AT_RSEQ_ALIGN. If rseq_len is the original rseq * size, the required alignment is the original struct rseq alignment. * - * In order to be valid, rseq_len is either the original rseq size, or - * large enough to contain all supported fields, as communicated to + * The rseq_len is required to be greater or equal to the original rseq + * size. In order to be valid, rseq_len is either the original rseq size, + * or large enough to contain all supported fields, as communicated to * user-space through the ELF auxiliary vector AT_RSEQ_FEATURE_SIZE. */ if (rseq_len < ORIG_RSEQ_SIZE || --=20 2.39.5 From nobody Fri Apr 3 07:54:12 2026 Received: from smtpout.efficios.com (smtpout.efficios.com [158.69.130.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id BBDE72727EB for ; Fri, 20 Feb 2026 20:06:52 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=158.69.130.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1771618014; cv=none; b=ZF/rHTubktiOaF9mCRQdrPaS2qwpwX9fbCmeOTB+iaKciJ/h+I29qgTIU1If5UBNPf2Pg0lWK4Zk8yFt7fqiK4BZYjNYJtQ9hZvUir/1XDo8LzZvU8hzXtKYCQ5xBYqAoKlP3qkbuZRyxXx7mMmow9+VQ2SLTxBD4OSKid3lPHo= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1771618014; c=relaxed/simple; bh=HREMc1gPEpy7VxWbKE89L9qA8Mx1fM6IR6xPW+X10zs=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=P3y0AvK+jnN+uEspVDBwnfniQSlIxhaGQilv5Hl8ftu+n4VvQd+LCGwXloADtXPzy63chnHHlnxj3oIzFvgpx40D3XLwgFIM2+2jv45BEJdZdPPJTv3tii6YHHayeEawAS1msdAPCc8gEfQQfu92Xqm4aKKr+qKsnGZ9TmFE4lQ= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=efficios.com; spf=pass smtp.mailfrom=efficios.com; dkim=pass (2048-bit key) header.d=efficios.com header.i=@efficios.com header.b=H4ieQYmD; arc=none smtp.client-ip=158.69.130.18 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=efficios.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=efficios.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=efficios.com header.i=@efficios.com header.b="H4ieQYmD" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=efficios.com; s=smtpout1; t=1771618006; bh=Q0sdYce4Aleo+V1K9r3RXP0Vc2GJbB/8EWb9bq0aVOk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=H4ieQYmDjDDnQsflE1sqUOKAFbkd40m2lfu/2zO92mozJAmiWSILvKoMWHc5MXmnM 8hmHUyvL1Gcl7z/O17PG+/6RBU2ZI+xfeW8ujkodnEV3sxdSOQrcZlt3TWSf7x83lQ d2/cKX+OS3vgkgX7lKKmuJZx6fwgEKas9Bzx7fG43z74I85fSuDbNdigD9BUhPoEvf z3laISGOQncSxNQ5kY65kvaeHSKbQ1/8gEb3Wapnk1wm3dag840j31g3XXBlhpbV9i jtjgT8aj8Ixg+0mjXu3GqxYuRoYCEuiTiPhTmm2tWsDDzpzezrp/7+pdhjo9Gkj4Hd Py3pcsO0UwH4A== Received: from thinkos.internal.efficios.com (mtl.efficios.com [216.120.195.104]) by smtpout.efficios.com (Postfix) with ESMTPSA id 4fHh924gSLzFtP; Fri, 20 Feb 2026 15:06:46 -0500 (EST) From: Mathieu Desnoyers To: Peter Zijlstra Cc: linux-kernel@vger.kernel.org, Mathieu Desnoyers , Ingo Molnar , Thomas Gleixner , Carlos O'Donell , Florian Weimer , Michael Jeanson Subject: [PATCH v3 2/2] rseq: slice ext: Ensure rseq feature size differs from original rseq size Date: Fri, 20 Feb 2026 15:06:41 -0500 Message-Id: <20260220200642.1317826-3-mathieu.desnoyers@efficios.com> X-Mailer: git-send-email 2.39.5 In-Reply-To: <20260220200642.1317826-1-mathieu.desnoyers@efficios.com> References: <20260220200642.1317826-1-mathieu.desnoyers@efficios.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Before rseq became extensible, its original size was 32 bytes even though the active rseq area was only 20 bytes. This had the following impact in terms of userspace ecosystem evolution: * The GNU libc between 2.35 and 2.39 expose a __rseq_size symbol set to 32, even though the size of the active rseq area is really 20. * The GNU libc 2.40 changes this __rseq_size to 20, thus making it express the active rseq area. * Starting from glibc 2.41, __rseq_size corresponds to the AT_RSEQ_FEATURE_SIZE from getauxval(3). This means that users of __rseq_size can always expect it to correspond to the active rseq area, except for the value 32, for which the active rseq area is 20 bytes. Exposing a 32 bytes feature size would make life needlessly painful for userspace. Therefore, add a reserved field at the end of the rseq area to bump the feature size to 33 bytes. This reserved field is expected to be replaced with whatever field will come next, expecting that this field will be larger than 1 byte. The effect of this change is to increase the size from 32 to 64 bytes before we actually have fields using that memory. Clarify the allocation size and alignment requirements in the struct rseq uapi comment. Change the value returned by getauxval(AT_RSEQ_ALIGN) to return the value of the active rseq area size rounded up to next power of 2, which guarantees that the rseq structure will always be aligned on the nearest power of two large enough to contain it, even as it grows. Change the alignment check in the rseq registration accordingly. This will minimize the amount of ABI corner-cases we need to document and require userspace to play games with. The rule stays simple when __rseq_size !=3D 32: #define rseq_field_available(field) (__rseq_size >=3D offsetofend(struct = rseq_abi, field)) Signed-off-by: Mathieu Desnoyers CC: Peter Zijlstra (Intel) CC: Ingo Molnar CC: Thomas Gleixner CC: Carlos O'Donell CC: Florian Weimer CC: Michael Jeanson --- Changes since v2: - Update struct rseq uapi comment. --- fs/binfmt_elf.c | 3 ++- include/linux/rseq.h | 12 ++++++++++++ include/uapi/linux/rseq.h | 26 ++++++++++++++++++++++---- kernel/rseq.c | 3 ++- 4 files changed, 38 insertions(+), 6 deletions(-) diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c index 3eb734c192e9..84c74b731b8c 100644 --- a/fs/binfmt_elf.c +++ b/fs/binfmt_elf.c @@ -47,6 +47,7 @@ #include #include #include +#include #include #include =20 @@ -286,7 +287,7 @@ create_elf_tables(struct linux_binprm *bprm, const stru= ct elfhdr *exec, } #ifdef CONFIG_RSEQ NEW_AUX_ENT(AT_RSEQ_FEATURE_SIZE, offsetof(struct rseq, end)); - NEW_AUX_ENT(AT_RSEQ_ALIGN, __alignof__(struct rseq)); + NEW_AUX_ENT(AT_RSEQ_ALIGN, rseq_alloc_align()); #endif #undef NEW_AUX_ENT /* AT_NULL is zero; clear the rest too */ diff --git a/include/linux/rseq.h b/include/linux/rseq.h index 7a01a0760405..b9d62fc2140d 100644 --- a/include/linux/rseq.h +++ b/include/linux/rseq.h @@ -146,6 +146,18 @@ static inline void rseq_fork(struct task_struct *t, u6= 4 clone_flags) t->rseq =3D current->rseq; } =20 +/* + * Value returned by getauxval(AT_RSEQ_ALIGN) and expected by rseq + * registration. This is the active rseq area size rounded up to next + * power of 2, which guarantees that the rseq structure will always be + * aligned on the nearest power of two large enough to contain it, even + * as it grows. + */ +static inline unsigned int rseq_alloc_align(void) +{ + return 1U << get_count_order(offsetof(struct rseq, end)); +} + #else /* CONFIG_RSEQ */ static inline void rseq_handle_slowpath(struct pt_regs *regs) { } static inline void rseq_signal_deliver(struct ksignal *ksig, struct pt_reg= s *regs) { } diff --git a/include/uapi/linux/rseq.h b/include/uapi/linux/rseq.h index 863c4a00a66b..f69344fe6c08 100644 --- a/include/uapi/linux/rseq.h +++ b/include/uapi/linux/rseq.h @@ -87,10 +87,17 @@ struct rseq_slice_ctrl { }; =20 /* - * struct rseq is aligned on 4 * 8 bytes to ensure it is always - * contained within a single cache-line. + * The original size and alignment of the allocation for struct rseq is + * 32 bytes. * - * A single struct rseq per thread is allowed. + * The allocation size needs to be greater or equal to + * max(getauxval(AT_RSEQ_FEATURE_SIZE), 32), and the allocation needs to + * be aligned on max(getauxval(AT_RSEQ_ALIGN), 32). + * + * As an alternative, userspace is allowed to use both the original size + * and alignment of 32 bytes for backward compatibility. + * + * A single active struct rseq registration per thread is allowed. */ struct rseq { /* @@ -180,10 +187,21 @@ struct rseq { */ struct rseq_slice_ctrl slice_ctrl; =20 + /* + * Before rseq became extensible, its original size was 32 bytes even + * though the active rseq area was only 20 bytes. + * Exposing a 32 bytes feature size would make life needlessly painful + * for userspace. Therefore, add a reserved byte after byte 32 + * to bump the rseq feature size from 32 to 33. + * The next field to be added to the rseq area will be larger + * than one byte, and will replace this reserved byte. + */ + __u8 __reserved; + /* * Flexible array member at end of structure, after last feature field. */ char end[]; -} __attribute__((aligned(4 * sizeof(__u64)))); +} __attribute__((aligned(32))); =20 #endif /* _UAPI_LINUX_RSEQ_H */ diff --git a/kernel/rseq.c b/kernel/rseq.c index e349f86cc945..38d3ef540760 100644 --- a/kernel/rseq.c +++ b/kernel/rseq.c @@ -80,6 +80,7 @@ #include #include #include +#include #include =20 #define CREATE_TRACE_POINTS @@ -456,7 +457,7 @@ SYSCALL_DEFINE4(rseq, struct rseq __user *, rseq, u32, = rseq_len, int, flags, u32 */ if (rseq_len < ORIG_RSEQ_SIZE || (rseq_len =3D=3D ORIG_RSEQ_SIZE && !IS_ALIGNED((unsigned long)rseq, O= RIG_RSEQ_SIZE)) || - (rseq_len !=3D ORIG_RSEQ_SIZE && (!IS_ALIGNED((unsigned long)rseq, __= alignof__(*rseq)) || + (rseq_len !=3D ORIG_RSEQ_SIZE && (!IS_ALIGNED((unsigned long)rseq, rs= eq_alloc_align()) || rseq_len < offsetof(struct rseq, end)))) return -EINVAL; if (!access_ok(rseq, rseq_len)) --=20 2.39.5