[PATCH] selftests/x86: Fix userfaultfd test for shadow stack rejection

["Ning, Hongyu" <hongyu.ning@linux.intel.com>]

Commit 3c58f641e813 ("userfaultfd: prevent registration of special
VMAs") prevents userfaultfd registration on shadow stack VMAs to avoid
bypassing shadow stack protections through UFFDIO_COPY.

The existing shadow stack selftest still expects UFFDIO_REGISTER to
succeed and uses UFFDIO_COPY to populate the shadow stack. This causes
the selftest to fail on Kernels containing this security fix.

Update the selftest to verify that UFFDIO_REGISTER rejects shadow stack
VMAs with EINVAL. Remove the obsolete userfaultfd fault handling thread
and UFFDIO_COPY test path.

Tested on: Intel shadow stack capable x86_64 platform

Before fix:
	[FAIL]  Userfaultfd test with return code 1

After fix:
	[OK]    Userfaultfd rejects shadow stack registration (EINVAL)

Fixes: 3c58f641e813 ("userfaultfd: prevent registration of special VMAs")

Signed-off-by: Hongyu Ning <hongyu.ning@linux.intel.com>

ChatGPT was used to assist with root-cause analysis and patch
preparation. The changes were reviewed and validated on Intel shadow
stack capable x86_64 platform, with all 12 shadow stack tests passing.
---
 .../testing/selftests/x86/test_shadow_stack.c | 105 ++++++------------
 1 file changed, 34 insertions(+), 71 deletions(-)

diff --git a/tools/testing/selftests/x86/test_shadow_stack.c b/tools/testing/selftests/x86/test_shadow_stack.c
index 3d6ca33edba4..d8d3122cbb43 100644
--- a/tools/testing/selftests/x86/test_shadow_stack.c
+++ b/tools/testing/selftests/x86/test_shadow_stack.c
@@ -27,7 +27,6 @@
 #include <sys/prctl.h>
 #include <stdint.h>
 #include <signal.h>
-#include <pthread.h>
 #include <sys/ioctl.h>
 #include <linux/userfaultfd.h>
 #include <setjmp.h>
@@ -450,48 +449,16 @@ int test_mprotect(void)
 	return 0;
 }
 
-char zero[4096];
-
-static void *uffd_thread(void *arg)
-{
-	struct uffdio_copy req;
-	int uffd = *(int *)arg;
-	struct uffd_msg msg;
-	int ret;
-
-	while (1) {
-		ret = read(uffd, &msg, sizeof(msg));
-		if (ret > 0)
-			break;
-		else if (errno == EAGAIN)
-			continue;
-		return (void *)1;
-	}
-
-	req.dst = msg.arg.pagefault.address;
-	req.src = (__u64)zero;
-	req.len = 4096;
-	req.mode = 0;
-
-	if (ioctl(uffd, UFFDIO_COPY, &req))
-		return (void *)1;
-
-	return (void *)0;
-}
-
+/*
+ * Shadow stack VMAs must not be registered with userfaultfd. In particular,
+ * UFFDIO_COPY must not be able to populate a shadow stack with arbitrary data.
+ */
 int test_userfaultfd(void)
 {
-	struct uffdio_register uffdio_register;
-	struct uffdio_api uffdio_api;
-	struct sigaction sa = {};
-	pthread_t thread;
-	void *res;
-	int uffd;
-
-	sa.sa_sigaction = test_access_fix_handler;
-	sa.sa_flags = SA_SIGINFO;
-	if (sigaction(SIGSEGV, &sa, NULL))
-		return 1;
+	struct uffdio_register uffdio_register = {};
+	struct uffdio_api uffdio_api = {};
+	void *shstk;
+	int uffd, ret = 1;
 
 	uffd = syscall(__NR_userfaultfd, O_CLOEXEC | O_NONBLOCK);
 	if (uffd < 0) {
@@ -499,43 +466,39 @@ int test_userfaultfd(void)
 		return 0;
 	}
 
-	reset_test_shstk(0);
+	shstk = create_shstk(0);
+	if (shstk == MAP_FAILED) {
+		printf("[FAIL]\tCould not create shadow stack\n");
+		close(uffd);
+		return 1;
+	}
 
 	uffdio_api.api = UFFD_API;
-	uffdio_api.features = 0;
-	if (ioctl(uffd, UFFDIO_API, &uffdio_api))
-		goto err;
+	if (ioctl(uffd, UFFDIO_API, &uffdio_api)) {
+		printf("[FAIL]\tUFFDIO_API failed: %s\n", strerror(errno));
+		goto out;
+	}
 
-	uffdio_register.range.start = (__u64)shstk_ptr;
-	uffdio_register.range.len = 4096;
+	uffdio_register.range.start = (__u64)shstk;
+	uffdio_register.range.len = PAGE_SIZE;
 	uffdio_register.mode = UFFDIO_REGISTER_MODE_MISSING;
-	if (ioctl(uffd, UFFDIO_REGISTER, &uffdio_register))
-		goto err;
-
-	if (pthread_create(&thread, NULL, &uffd_thread, &uffd))
-		goto err;
-
-	reset_shstk(shstk_ptr);
-	test_shstk_access(shstk_ptr);
-
-	if (pthread_join(thread, &res))
-		goto err;
-
-	if (test_shstk_access(shstk_ptr))
-		goto err;
-
-	free_shstk(shstk_ptr);
+	if (!ioctl(uffd, UFFDIO_REGISTER, &uffdio_register)) {
+		printf("[FAIL]\tUserfaultfd registered a shadow stack VMA\n");
+		goto out;
+	}
 
-	signal(SIGSEGV, SIG_DFL);
+	if (errno != EINVAL) {
+		printf("[FAIL]\tUFFDIO_REGISTER: expected EINVAL, got %s\n",
+		       strerror(errno));
+		goto out;
+	}
 
-	if (!res)
-		printf("[OK]\tUserfaultfd test\n");
-	return !!res;
-err:
-	free_shstk(shstk_ptr);
+	printf("[OK]\tUserfaultfd rejects shadow stack registration (EINVAL)\n");
+	ret = 0;
+out:
+	free_shstk(shstk);
 	close(uffd);
-	signal(SIGSEGV, SIG_DFL);
-	return 1;
+	return ret;
 }
 
 /* Simple linked list for keeping track of mappings in test_guard_gap() */
-- 
2.43.0