Skip to content

arm64, riscv: release shadow stacks on failed fork

Iván Ezequiel Rodriguez linux-arm-kernel linux-kselftest linux-riscv lkml stable 3 versions – Applied

Status from this message: Applied to arm64 (for-next/core), thanks!

Get series with b4
b4 am [email protected]

Versions newest first · linked by author and title

  1. v3 Latest4 patches 5 repliesApplied
  2. v24 patches 1 replySuperseded
  3. v14 patches 2 repliesSuperseded

Changes in v3 from the cover letter

- Move gcs_reset_thread() into process.c (Mark Brown).
- Spell out the x86 vs arm64/riscv difference above.

Patches in v3 Applied

#Subject and filesSizeRepliesApplied
1/4arm64/gcs: release GCS on failed forkarch/arm64/Kconfig arch/arm64/kernel/process.c+17 -03 replies
2/4riscv/shstk: release shadow stack on failed forkarch/riscv/Kconfig arch/riscv/kernel/process.c+10 -00 replies
3/4selftests/arm64: GCS must not leak on a failed clone3tools/testing/selftests/arm64/gcs/Makefile tools/testing/selftests/arm64/gcs/gcs-clone-pidfd.c tools/testing/selftests/arm64/gcs/gcs-locking.c +2 more+194 -411 reply
4/4selftests/riscv: shadow stack must not leak on a failed clone3tools/testing/selftests/riscv/cfi/Makefile tools/testing/selftests/riscv/cfi/shstk-clone-pidfd.c+177 -10 replies

Reviews trailers per patch

2 of 4 patches have a Reviewed-by or Acked-by of their own; the series has one for all of them.

PatchMark Brown
SeriesR-b
1/4R-b T-b
2/4
3/4R-b T-b
4/4

Trailers given in replies are filled; those carried in the patches from earlier versions are outlined with dashes.

Read the v3 thread

Cover letter [PATCH v3 0/4] arm64, riscv: release shadow stacks on failed fork

clone3(CLONE_VM|CLONE_PIDFD) can fail in put_user() after copy_thread() has mapped a shadow stack into the shared mm. copy_process() then calls exit_thread(). arm64 and riscv did not implement it, so the VMA leaked.

x86 already frees via exit_thread() -> shstk_free(). Its separate TLS leak is when copy_thread() fails after the alloc and skips exit_thread().

Changes since v2:
- Move gcs_reset_thread() into process.c (Mark Brown).
- Spell out the x86 vs arm64/riscv difference above.

v2: https://lore.kernel.org/all/[email protected]/

Assisted-by LLM

Iván Ezequiel Rodriguez (4):
arm64/gcs: release GCS on failed fork
riscv/shstk: release shadow stack on failed fork selftests/arm64: GCS must not leak on a failed clone3 selftests/riscv: shadow stack must not leak on a failed clone3

 arch/arm64/Kconfig                            |   1 +
 arch/arm64/kernel/process.c                   |  16 ++
 arch/riscv/Kconfig                            |   1 +
 arch/riscv/kernel/process.c                   |   9 +
 tools/testing/selftests/arm64/gcs/Makefile    |   3 +-
 .../selftests/arm64/gcs/gcs-clone-pidfd.c     | 168 +++++++++++++++++
 .../testing/selftests/arm64/gcs/gcs-locking.c |  20 --
 tools/testing/selftests/arm64/gcs/gcs-util.h  |  24 +++
 tools/testing/selftests/arm64/gcs/libc-gcs.c  |  20 --
 tools/testing/selftests/riscv/cfi/Makefile    |   5 +-
 .../selftests/riscv/cfi/shstk-clone-pidfd.c   | 173 ++++++++++++++++++
 11 files changed, 398 insertions(+), 42 deletions(-)
 create mode 100644 tools/testing/selftests/arm64/gcs/gcs-clone-pidfd.c
 create mode 100644 tools/testing/selftests/riscv/cfi/shstk-clone-pidfd.c
Signature · 1 line
2.43.0

Read the cover letter in its thread