On Tue, Aug 06, 2024 at 10:57:39PM +0100, Mark Brown wrote:

On Tue, Aug 06, 2024 at 02:43:22PM -0700, Kees Cook wrote:

quoted

"Shadow stack with no token" still crashes the parent. It seems to
crash in waitpid(). Under gdb it hangs instead, showing it's in glibc's
__GI___wait4(). Ah, it's crashing at c3 (ret), so shadow stack problem,
I imagine.

Yes, likely.  They are delivered as a SEGV with SEGV_CPERR.

quoted

Does waitpid() need to be open-coded like the clone3() call too?

I wouldn't have expected so, it should just be a function call and
definitely didn't do anything funky on arm64.  It seems more likely that
we've managed to corrupt the stack or shadow stack - most likely the new
thread is still using the original shadow stack rather than the new one
and so corrupts it.  Again not immediately seeing where.  I'll have
another look tomorrow if nobody has any bright ideas before then...

...or possibly we're delivering the signal that's generated when we fail
to validate the child's shadow stack token to the parent rather than the
child.  That logic (in shstk_post_fork()) should be shared with arm64
though so it ought to have been failing for me too.  Failure to validate
the token should look to the parent like the child immediately taking a
shadow stack fault.