On Tue, Aug 06, 2024 at 02:43:22PM -0700, Kees Cook wrote: > On Tue, Aug 06, 2024 at 09:10:28PM +0100, Mark Brown wrote: > > Does this help: > > diff --git a/arch/x86/kernel/shstk.c b/arch/x86/kernel/shstk.c > > index 1755fa21e6fb..27acbdf44c5f 100644 > > --- a/arch/x86/kernel/shstk.c > > +++ b/arch/x86/kernel/shstk.c > > @@ -198,13 +198,14 @@ int arch_shstk_post_fork(struct task_struct *t, struct kernel_clone_args *args) > > * the token 64-bit. > > */ > > struct mm_struct *mm; > > - unsigned long addr; > > + unsigned long addr, ssp; > Yes indeed! This passes now. Ah, great - thanks! > "Shadow stack with no token" still crashes the parent. It seems to > crash in waitpid(). Under gdb it hangs instead, showing it's in glibc's > __GI___wait4(). Ah, it's crashing at c3 (ret), so shadow stack problem, > I imagine. Yes, likely. They are delivered as a SEGV with SEGV_CPERR. > Does waitpid() need to be open-coded like the clone3() call too? I wouldn't have expected so, it should just be a function call and definitely didn't do anything funky on arm64. It seems more likely that we've managed to corrupt the stack or shadow stack - most likely the new thread is still using the original shadow stack rather than the new one and so corrupts it. Again not immediately seeing where. I'll have another look tomorrow if nobody has any bright ideas before then...
Attachment:
signature.asc
Description: PGP signature
