This is the mail archive of the mailing list for the glibc project.

Index Nav: [Date Index] [Subject Index] [Author Index] [Thread Index]
Message Nav: [Date Prev] [Date Next] [Thread Prev] [Thread Next]
Other format: [Raw text]

Re: RFC: Shadow Stack support in glibc

On Mon, 2017-06-05 at 23:18 -0700, Florian Weimer wrote:
> On 06/05/2017 11:36 PM, H.J. Lu wrote:
> > Most of glibc functions are compatible with Shadow Stack, except for
> >
> > 1. setjmp/longjmp need to be extended to support Shadow Stack.
> > 2. getcontext/setcontext may be extended to support Shadow Stack.
> > 3. makecontext/swapcontext are hard to support Shadow Stack.
> What about these?
> clone
> sigaltstack
> pthread_attr_setstack
> pthread_attr_setstackaddr
> pthread_attr_setstacksize

Please comment on the following.



The child's shadow stack can be copied on access, similar to
copy-on-write of a regular memory page.  A shadow stack PTE has to be
dirty and read-only.  When a task is cloned, the kernel makes shadow
stack PTEs clean until they are accessed again.  At that time, a copy is


When the kernel gets the sigaltstack syscall, it allocates a
shadow_sigaltstack and records the pointer in the task header (similar
to the existing sigaltstack pointer).  If there is another sigaltstack
syscall, the kernel frees the previous shadow_sigaltstack; else, the
shadow_sigaltstack is freed upon task exit.


Since shadow stack stores only return pointers, it is not affected by
the address/size of the program stack.

Index Nav: [Date Index] [Subject Index] [Author Index] [Thread Index]
Message Nav: [Date Prev] [Date Next] [Thread Prev] [Thread Next]