On Fri, Dec 02, 2022 at 04:35:54PM -0800, Rick Edgecombe wrote: > From: Yu-cheng Yu <yu-cheng.yu@xxxxxxxxx> > > When a process is duplicated, but the child shares the address space with > the parent, there is potential for the threads sharing a single stack to > cause conflicts for each other. In the normal non-cet case this is handled > in two ways. > > With regular CLONE_VM a new stack is provided by userspace such that the > parent and child have different stacks. > > For vfork, the parent is suspended until the child exits. So as long as > the child doesn't return from the vfork()/CLONE_VFORK calling function and > sticks to a limited set of operations, the parent and child can share the > same stack. > > For shadow stack, these scenarios present similar sharing problems. For the > CLONE_VM case, the child and the parent must have separate shadow stacks. > Instead of changing clone to take a shadow stack, have the kernel just > allocate one and switch to it. > > Use stack_size passed from clone3() syscall for thread shadow stack size. A > compat-mode thread shadow stack size is further reduced to 1/4. This > allows more threads to run in a 32-bit address space. The clone() does not > pass stack_size, which was added to clone3(). In that case, use > RLIMIT_STACK size and cap to 4 GB. > > For shadow stack enabled vfork(), the parent and child can share the same > shadow stack, like they can share a normal stack. Since the parent is > suspended until the child terminates, the child will not interfere with > the parent while executing as long as it doesn't return from the vfork() > and overwrite up the shadow stack. The child can safely overwrite down > the shadow stack, as the parent can just overwrite this later. So CET does > not add any additional limitations for vfork(). > > Userspace implementing posix vfork() can actually prevent the child from > returning from the vfork() calling function, using CET. Glibc does this > by adjusting the shadow stack pointer in the child, so that the child > receives a #CP if it tries to return from vfork() calling function. > > Free the shadow stack on thread exit by doing it in mm_release(). Skip > this when exiting a vfork() child since the stack is shared in the > parent. > > During this operation, the shadow stack pointer of the new thread needs > to be updated to point to the newly allocated shadow stack. Since the > ability to do this is confined to the FPU subsystem, change > fpu_clone() to take the new shadow stack pointer, and update it > internally inside the FPU subsystem. This part was suggested by Thomas > Gleixner. > > Tested-by: Pengfei Xu <pengfei.xu@xxxxxxxxx> > Tested-by: John Allen <john.allen@xxxxxxx> > Suggested-by: Thomas Gleixner <tglx@xxxxxxxxxxxxx> > Signed-off-by: Yu-cheng Yu <yu-cheng.yu@xxxxxxxxx> Reviewed-by: Kees Cook <keescook@xxxxxxxxxxxx> -- Kees Cook
