linux-kernel - Re: [PATCH RFT v7 9/9] selftests/clone3: Test shadow stack support

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <43aa4846-1cb9-4130-80ed-12ec8219ddc0@sirena.org.uk>
Date: Tue, 6 Aug 2024 23:21:20 +0100
From: Mark Brown <broonie@...nel.org>
To: Kees Cook <kees@...nel.org>
Cc: "Rick P. Edgecombe" <rick.p.edgecombe@...el.com>,
	Deepak Gupta <debug@...osinc.com>,
	Szabolcs Nagy <Szabolcs.Nagy@....com>,
	"H.J. Lu" <hjl.tools@...il.com>,
	Florian Weimer <fweimer@...hat.com>,
	Thomas Gleixner <tglx@...utronix.de>,
	Ingo Molnar <mingo@...hat.com>, Borislav Petkov <bp@...en8.de>,
	Dave Hansen <dave.hansen@...ux.intel.com>, x86@...nel.org,
	"H. Peter Anvin" <hpa@...or.com>,
	Peter Zijlstra <peterz@...radead.org>,
	Juri Lelli <juri.lelli@...hat.com>,
	Vincent Guittot <vincent.guittot@...aro.org>,
	Dietmar Eggemann <dietmar.eggemann@....com>,
	Steven Rostedt <rostedt@...dmis.org>,
	Ben Segall <bsegall@...gle.com>, Mel Gorman <mgorman@...e.de>,
	Valentin Schneider <vschneid@...hat.com>,
	Christian Brauner <brauner@...nel.org>,
	Shuah Khan <shuah@...nel.org>, linux-kernel@...r.kernel.org,
	Catalin Marinas <catalin.marinas@....com>,
	Will Deacon <will@...nel.org>, jannh@...gle.com,
	linux-kselftest@...r.kernel.org, linux-api@...r.kernel.org
Subject: Re: [PATCH RFT v7 9/9] selftests/clone3: Test shadow stack support

On Tue, Aug 06, 2024 at 10:57:39PM +0100, Mark Brown wrote:
> On Tue, Aug 06, 2024 at 02:43:22PM -0700, Kees Cook wrote:

> > "Shadow stack with no token" still crashes the parent. It seems to
> > crash in waitpid(). Under gdb it hangs instead, showing it's in glibc's
> > __GI___wait4(). Ah, it's crashing at c3 (ret), so shadow stack problem,
> > I imagine.

> Yes, likely.  They are delivered as a SEGV with SEGV_CPERR.

> > Does waitpid() need to be open-coded like the clone3() call too?

> I wouldn't have expected so, it should just be a function call and
> definitely didn't do anything funky on arm64.  It seems more likely that
> we've managed to corrupt the stack or shadow stack - most likely the new
> thread is still using the original shadow stack rather than the new one
> and so corrupts it.  Again not immediately seeing where.  I'll have
> another look tomorrow if nobody has any bright ideas before then...

...or possibly we're delivering the signal that's generated when we fail
to validate the child's shadow stack token to the parent rather than the
child.  That logic (in shstk_post_fork()) should be shared with arm64
though so it ought to have been failing for me too.  Failure to validate
the token should look to the parent like the child immediately taking a
shadow stack fault.

Download attachment "signature.asc" of type "application/pgp-signature" (489 bytes)