[PATCH] x86/CET: Update vfork to prevent child return
Florian Weimer
fw@deneb.enyo.de
Thu Sep 17 00:46:41 GMT 2020
* H. J. Lu via Libc-alpha:
> Child of vfork should either call _exit or one of the exec family of
> functions. But normally there is nothing to prevent child of vfork from
> returning to caller of vfork's caller. With shadow stack enabled, we
> can introduce mismatched shadow stack in child of vfork. When the child
> returns from the function in which vfork was called, mismatched shadow
> stack will trigger SIGSEGV.
> ---
> sysdeps/unix/sysv/linux/i386/vfork.S | 6 +++
> sysdeps/unix/sysv/linux/x86/Makefile | 5 ++
> sysdeps/unix/sysv/linux/x86/tst-cet-vfork-1.c | 54 +++++++++++++++++++
> sysdeps/unix/sysv/linux/x86_64/vfork.S | 6 +++
> 4 files changed, 71 insertions(+)
> create mode 100644 sysdeps/unix/sysv/linux/x86/tst-cet-vfork-1.c
>
> diff --git a/sysdeps/unix/sysv/linux/i386/vfork.S b/sysdeps/unix/sysv/linux/i386/vfork.S
> index ceb41db0bd..e54fdb7e4c 100644
> --- a/sysdeps/unix/sysv/linux/i386/vfork.S
> +++ b/sysdeps/unix/sysv/linux/i386/vfork.S
> @@ -91,6 +91,12 @@ ENTRY (__vfork)
> /* Normal return if shadow stack isn't in use. */
> je L(no_shstk)
>
> + testl %eax, %eax
> + jnz 2f
> + /* NB: Jump back to caller directly with mismatched shadow stack
> + to prevent child return. */
> + jmp *%ecx
> +2:
Doesn't the jmp need a notrack prefix? Or does GCC generate special
code for returns_twice functions?
The comment should say that the *function* calling vfork cannot return
in the subprocess.
> diff --git a/sysdeps/unix/sysv/linux/x86/Makefile b/sysdeps/unix/sysv/linux/x86/Makefile
> index 920edd8948..f3fae85c1e 100644
> --- a/sysdeps/unix/sysv/linux/x86/Makefile
> +++ b/sysdeps/unix/sysv/linux/x86/Makefile
> @@ -47,6 +47,11 @@ $(objpfx)tst-cet-property-2.out: $(objpfx)tst-cet-property-2 \
> $(evaluate-test)
> endif
>
> +ifeq ($(subdir),posix)
> +tests += tst-cet-vfork-1
> +CFLAGS-tst-cet-vfork-1.c += -mshstk
> +endif
Does -mshstk alter the ISA? Then I think you can't test for the
presence of support if you build the whole translation unit with
-mshstk.
> diff --git a/sysdeps/unix/sysv/linux/x86/tst-cet-vfork-1.c b/sysdeps/unix/sysv/linux/x86/tst-cet-vfork-1.c
> new file mode 100644
> index 0000000000..9ca148e857
> --- /dev/null
> +++ b/sysdeps/unix/sysv/linux/x86/tst-cet-vfork-1.c
> @@ -0,0 +1,54 @@
> +/* Verify that child of vfork can't return with shadow stack.
Likewise: It's the vfork-calling function that must not return.
> +__attribute__ ((noclone, noinline))
> +static pid_t
> +do_test_1 (void)
> +{
> + pid_t pid;
> +
> + pid = vfork ();
> + if (pid == 0)
> + {
> + /* Child return should trigger SIGSEGV. */
> + return 0;
> + }
> + _exit (EXIT_SUCCESS);
> +
> + return pid;
The return statement immediately above is unreachable.
> +static int
> +do_test (void)
> +{
> + /* NB: This test should trigger SIGSEGV with shadow stack enabled. */
> + if (_get_ssp () == 0)
> + return EXIT_UNSUPPORTED;
> + return do_test_1 () ? EXIT_SUCCESS : EXIT_FAILURE;
> +}
> +
> +#define EXPECTED_SIGNAL (_get_ssp () == 0 ? 0 : SIGSEGV)
> +#include <support/test-driver.c>
I'm surprised EXPECTED_SIGNAL works here. I would expect that the
original test process would have to wait using xwaitpid and check for
the signal in the subprocess.
I think it would also be good to add a check that the subprocess
actually returned from vfork without crashing, say using a pipe and a
write before the return statement.
> diff --git a/sysdeps/unix/sysv/linux/x86_64/vfork.S b/sysdeps/unix/sysv/linux/x86_64/vfork.S
> index 776d2fc610..5dd5cb714c 100644
> --- a/sysdeps/unix/sysv/linux/x86_64/vfork.S
> +++ b/sysdeps/unix/sysv/linux/x86_64/vfork.S
> @@ -71,6 +71,12 @@ ENTRY (__vfork)
> /* Normal return if shadow stack isn't in use. */
> je L(no_shstk)
>
> + testl %eax, %eax
> + jnz 2f
> + /* NB: Jump back to caller directly with mismatched shadow stack
> + to prevent child return. */
> + jmp *%rdi
> +2:
> /* Pop return address from shadow stack and jump back to caller
> directly. */
> movl $1, %esi
See above.
More information about the Libc-alpha
mailing list