On Wed, Feb 10, 2021 at 01:38:10PM -0800, Yu, Yu-cheng wrote:

On 2/10/2021 11:58 AM, Kees Cook wrote:

quoted

On Wed, Feb 10, 2021 at 09:56:59AM -0800, Yu-cheng Yu wrote:

quoted

To deliver a signal, create a shadow stack restore token and put the token
and the signal restorer address on the shadow stack.  For sigreturn, verify
the token and restore from it the shadow stack pointer.

A shadow stack restore token marks a restore point of the shadow stack.
The token is distinctively different from any shadow stack address.

How is it different? It seems like it just has the last 2 bits
masked/set?

For example, for 64-bit apps,

A shadow stack pointer value (*ssp) has to be in some code area, but for a
token, (*ptr_of_token) = (ptr_of_token + 8), which has to be within the same
shadow stack area.  In cet_verify_rstor_token(), this is checked.

quoted

quoted

In sigreturn, restoring from a token ensures the target address is the
location pointed by the token.

As in, a token (real stack address with 2-bit mask) is checked against
the real stack address? I don't see a comparison -- it only checks that
it is < TASK_SIZE.

How does cet_restore_signal() figure into this? (As in, the MSR writes?)

The kernel takes the restore address from the token.  It will not mistakenly
take a wrong address from the shadow stack.  I will put this in my commit
logs.

Ah-ha, okay, got it now. Thank you!

Reviewed-by: Kees Cook <redacted>

-- 
Kees Cook