On Sat, 2024-02-03 at 00:05 +0000, Mark Brown wrote: > + if (args->shadow_stack) { > + addr = args->shadow_stack; > + size = args->shadow_stack_size; > > - size = adjust_shstk_size(stack_size); > - addr = alloc_shstk(0, size, 0, false); > - if (IS_ERR_VALUE(addr)) > - return addr; > + /* There should be a valid token at the top of the > stack. */ > + if (!shstk_consume_token(tsk, addr + size - > sizeof(u64))) > + return (unsigned long)ERR_PTR(-EINVAL); I think for this case, it needs: shstk->base = 0; shstk->size = 0; To prevent trying to free the parents shadow stack when the child exits.