On Tue, Aug 06, 2024 at 10:57:39PM +0100, Mark Brown wrote: > On Tue, Aug 06, 2024 at 02:43:22PM -0700, Kees Cook wrote: > > "Shadow stack with no token" still crashes the parent. It seems to > > crash in waitpid(). Under gdb it hangs instead, showing it's in glibc's > > __GI___wait4(). Ah, it's crashing at c3 (ret), so shadow stack problem, > > I imagine. > Yes, likely. They are delivered as a SEGV with SEGV_CPERR. > > Does waitpid() need to be open-coded like the clone3() call too? > I wouldn't have expected so, it should just be a function call and > definitely didn't do anything funky on arm64. It seems more likely that > we've managed to corrupt the stack or shadow stack - most likely the new > thread is still using the original shadow stack rather than the new one > and so corrupts it. Again not immediately seeing where. I'll have > another look tomorrow if nobody has any bright ideas before then... ...or possibly we're delivering the signal that's generated when we fail to validate the child's shadow stack token to the parent rather than the child. That logic (in shstk_post_fork()) should be shared with arm64 though so it ought to have been failing for me too. Failure to validate the token should look to the parent like the child immediately taking a shadow stack fault.
Attachment:
signature.asc
Description: PGP signature
