On Wed, Feb 10, 2021 at 01:38:10PM -0800, Yu, Yu-cheng wrote: > On 2/10/2021 11:58 AM, Kees Cook wrote: > > On Wed, Feb 10, 2021 at 09:56:59AM -0800, Yu-cheng Yu wrote: > > > To deliver a signal, create a shadow stack restore token and put the token > > > and the signal restorer address on the shadow stack. For sigreturn, verify > > > the token and restore from it the shadow stack pointer. > > > > > > A shadow stack restore token marks a restore point of the shadow stack. > > > The token is distinctively different from any shadow stack address. > > > > How is it different? It seems like it just has the last 2 bits > > masked/set? > > > > For example, for 64-bit apps, > > A shadow stack pointer value (*ssp) has to be in some code area, but for a > token, (*ptr_of_token) = (ptr_of_token + 8), which has to be within the same > shadow stack area. In cet_verify_rstor_token(), this is checked. > > > > In sigreturn, restoring from a token ensures the target address is the > > > location pointed by the token. > > > > As in, a token (real stack address with 2-bit mask) is checked against > > the real stack address? I don't see a comparison -- it only checks that > > it is < TASK_SIZE. > > > > How does cet_restore_signal() figure into this? (As in, the MSR writes?) > > > > The kernel takes the restore address from the token. It will not mistakenly > take a wrong address from the shadow stack. I will put this in my commit > logs. Ah-ha, okay, got it now. Thank you! Reviewed-by: Kees Cook <keescook@xxxxxxxxxxxx> -- Kees Cook
