linux-kernel - Re: [PATCH RFT v7 9/9] selftests/clone3: Test shadow stack support

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <18c16157-f75b-4054-af80-d0fe696d7370@sirena.org.uk>
Date: Tue, 6 Aug 2024 22:57:30 +0100
From: Mark Brown <broonie@...nel.org>
To: Kees Cook <kees@...nel.org>
Cc: "Rick P. Edgecombe" <rick.p.edgecombe@...el.com>,
	Deepak Gupta <debug@...osinc.com>,
	Szabolcs Nagy <Szabolcs.Nagy@....com>,
	"H.J. Lu" <hjl.tools@...il.com>,
	Florian Weimer <fweimer@...hat.com>,
	Thomas Gleixner <tglx@...utronix.de>,
	Ingo Molnar <mingo@...hat.com>, Borislav Petkov <bp@...en8.de>,
	Dave Hansen <dave.hansen@...ux.intel.com>, x86@...nel.org,
	"H. Peter Anvin" <hpa@...or.com>,
	Peter Zijlstra <peterz@...radead.org>,
	Juri Lelli <juri.lelli@...hat.com>,
	Vincent Guittot <vincent.guittot@...aro.org>,
	Dietmar Eggemann <dietmar.eggemann@....com>,
	Steven Rostedt <rostedt@...dmis.org>,
	Ben Segall <bsegall@...gle.com>, Mel Gorman <mgorman@...e.de>,
	Valentin Schneider <vschneid@...hat.com>,
	Christian Brauner <brauner@...nel.org>,
	Shuah Khan <shuah@...nel.org>, linux-kernel@...r.kernel.org,
	Catalin Marinas <catalin.marinas@....com>,
	Will Deacon <will@...nel.org>, jannh@...gle.com,
	linux-kselftest@...r.kernel.org, linux-api@...r.kernel.org
Subject: Re: [PATCH RFT v7 9/9] selftests/clone3: Test shadow stack support

On Tue, Aug 06, 2024 at 02:43:22PM -0700, Kees Cook wrote:
> On Tue, Aug 06, 2024 at 09:10:28PM +0100, Mark Brown wrote:

> > Does this help:

> > diff --git a/arch/x86/kernel/shstk.c b/arch/x86/kernel/shstk.c
> > index 1755fa21e6fb..27acbdf44c5f 100644
> > --- a/arch/x86/kernel/shstk.c
> > +++ b/arch/x86/kernel/shstk.c
> > @@ -198,13 +198,14 @@ int arch_shstk_post_fork(struct task_struct *t, struct kernel_clone_args *args)
> >  	 * the token 64-bit.
> >  	 */
> >  	struct mm_struct *mm;
> > -	unsigned long addr;
> > +	unsigned long addr, ssp;

> Yes indeed! This passes now.

Ah, great - thanks!

> "Shadow stack with no token" still crashes the parent. It seems to
> crash in waitpid(). Under gdb it hangs instead, showing it's in glibc's
> __GI___wait4(). Ah, it's crashing at c3 (ret), so shadow stack problem,
> I imagine.

Yes, likely.  They are delivered as a SEGV with SEGV_CPERR.

> Does waitpid() need to be open-coded like the clone3() call too?

I wouldn't have expected so, it should just be a function call and
definitely didn't do anything funky on arm64.  It seems more likely that
we've managed to corrupt the stack or shadow stack - most likely the new
thread is still using the original shadow stack rather than the new one
and so corrupts it.  Again not immediately seeing where.  I'll have
another look tomorrow if nobody has any bright ideas before then...

Download attachment "signature.asc" of type "application/pgp-signature" (489 bytes)