The 07/11/2023 09:08, szabolcs.nagy--- via Libc-alpha wrote: > the decision is for x86 shadow stack linux abi to use > > shadow stack size = stack size > > or > > shadow stack size = stack size + 1 page > > as default policy when alt stack signals use the same > shadow stack, not a separate one. > > note: smallest stack frame size is 8bytes, same as the > shadow stack entry. on a target where smallest frame > size is 2x shadow stack entry size, the formula would > use (stack size / 2). i convinced myself that shadow stack size = stack size works: libc can reserve N bytes on the initial stack frame so when the stack overflows there will be at least N bytes on the shadow stack usable for signal handling. this is only bad for tiny user allocated stacks where libc should not consume too much stack space. but e.g. glibc already uses >128 bytes on the initial stack frame for its cancellation jumpbuf so 16 deep signal call stack is already guaranteed to work. the glibc makecontext code has to be adjusted, but that's a libc side discussion. the shadow stack of the main stack can still overflow, but that requires increasing RLIMIT_STACK at runtime which is not very common.
