[PATCH] selftests/x86: Fix userfaultfd test for shadow stack rejection

[PATCH] selftests/x86: Fix userfaultfd test for shadow stack rejection

[Ning, Hongyu]

Commit 3c58f641e813 ("userfaultfd: prevent registration of special
VMAs") prevents userfaultfd registration on shadow stack VMAs to avoid
bypassing shadow stack protections through UFFDIO_COPY.

The existing shadow stack selftest still expects UFFDIO_REGISTER to
succeed and uses UFFDIO_COPY to populate the shadow stack. This causes
the selftest to fail on Kernels containing this security fix.

Update the selftest to verify that UFFDIO_REGISTER rejects shadow stack
VMAs with EINVAL. Remove the obsolete userfaultfd fault handling thread
and UFFDIO_COPY test path.

Tested on: Intel shadow stack capable x86_64 platform

Before fix:
	[FAIL]  Userfaultfd test with return code 1

After fix:
	[OK]    Userfaultfd rejects shadow stack registration (EINVAL)

Fixes: 3c58f641e813 ("userfaultfd: prevent registration of special VMAs")

Signed-off-by: Hongyu Ning <hongyu.ning@linux.intel.com>

ChatGPT was used to assist with root-cause analysis and patch
preparation. The changes were reviewed and validated on Intel shadow
stack capable x86_64 platform, with all 12 shadow stack tests passing.
---
 .../testing/selftests/x86/test_shadow_stack.c | 105 ++++++------------
 1 file changed, 34 insertions(+), 71 deletions(-)

diff --git a/tools/testing/selftests/x86/test_shadow_stack.c b/tools/testing/selftests/x86/test_shadow_stack.c
index 3d6ca33edba4..d8d3122cbb43 100644
--- a/tools/testing/selftests/x86/test_shadow_stack.c
+++ b/tools/testing/selftests/x86/test_shadow_stack.c
@@ -27,7 +27,6 @@
 #include <sys/prctl.h>
 #include <stdint.h>
 #include <signal.h>
-#include <pthread.h>
 #include <sys/ioctl.h>
 #include <linux/userfaultfd.h>
 #include <setjmp.h>
@@ -450,48 +449,16 @@ int test_mprotect(void)
 	return 0;
 }
 
-char zero[4096];
-
-static void *uffd_thread(void *arg)
-{
-	struct uffdio_copy req;
-	int uffd = *(int *)arg;
-	struct uffd_msg msg;
-	int ret;
-
-	while (1) {
-		ret = read(uffd, &msg, sizeof(msg));
-		if (ret > 0)
-			break;
-		else if (errno == EAGAIN)
-			continue;
-		return (void *)1;
-	}
-
-	req.dst = msg.arg.pagefault.address;
-	req.src = (__u64)zero;
-	req.len = 4096;
-	req.mode = 0;
-
-	if (ioctl(uffd, UFFDIO_COPY, &req))
-		return (void *)1;
-
-	return (void *)0;
-}
-
+/*
+ * Shadow stack VMAs must not be registered with userfaultfd. In particular,
+ * UFFDIO_COPY must not be able to populate a shadow stack with arbitrary data.
+ */
 int test_userfaultfd(void)
 {
-	struct uffdio_register uffdio_register;
-	struct uffdio_api uffdio_api;
-	struct sigaction sa = {};
-	pthread_t thread;
-	void *res;
-	int uffd;
-
-	sa.sa_sigaction = test_access_fix_handler;
-	sa.sa_flags = SA_SIGINFO;
-	if (sigaction(SIGSEGV, &sa, NULL))
-		return 1;
+	struct uffdio_register uffdio_register = {};
+	struct uffdio_api uffdio_api = {};
+	void *shstk;
+	int uffd, ret = 1;
 
 	uffd = syscall(__NR_userfaultfd, O_CLOEXEC | O_NONBLOCK);
 	if (uffd < 0) {
@@ -499,43 +466,39 @@ int test_userfaultfd(void)
 		return 0;
 	}
 
-	reset_test_shstk(0);
+	shstk = create_shstk(0);
+	if (shstk == MAP_FAILED) {
+		printf("[FAIL]\tCould not create shadow stack\n");
+		close(uffd);
+		return 1;
+	}
 
 	uffdio_api.api = UFFD_API;
-	uffdio_api.features = 0;
-	if (ioctl(uffd, UFFDIO_API, &uffdio_api))
-		goto err;
+	if (ioctl(uffd, UFFDIO_API, &uffdio_api)) {
+		printf("[FAIL]\tUFFDIO_API failed: %s\n", strerror(errno));
+		goto out;
+	}
 
-	uffdio_register.range.start = (__u64)shstk_ptr;
-	uffdio_register.range.len = 4096;
+	uffdio_register.range.start = (__u64)shstk;
+	uffdio_register.range.len = PAGE_SIZE;
 	uffdio_register.mode = UFFDIO_REGISTER_MODE_MISSING;
-	if (ioctl(uffd, UFFDIO_REGISTER, &uffdio_register))
-		goto err;
-
-	if (pthread_create(&thread, NULL, &uffd_thread, &uffd))
-		goto err;
-
-	reset_shstk(shstk_ptr);
-	test_shstk_access(shstk_ptr);
-
-	if (pthread_join(thread, &res))
-		goto err;
-
-	if (test_shstk_access(shstk_ptr))
-		goto err;
-
-	free_shstk(shstk_ptr);
+	if (!ioctl(uffd, UFFDIO_REGISTER, &uffdio_register)) {
+		printf("[FAIL]\tUserfaultfd registered a shadow stack VMA\n");
+		goto out;
+	}
 
-	signal(SIGSEGV, SIG_DFL);
+	if (errno != EINVAL) {
+		printf("[FAIL]\tUFFDIO_REGISTER: expected EINVAL, got %s\n",
+		       strerror(errno));
+		goto out;
+	}
 
-	if (!res)
-		printf("[OK]\tUserfaultfd test\n");
-	return !!res;
-err:
-	free_shstk(shstk_ptr);
+	printf("[OK]\tUserfaultfd rejects shadow stack registration (EINVAL)\n");
+	ret = 0;
+out:
+	free_shstk(shstk);
 	close(uffd);
-	signal(SIGSEGV, SIG_DFL);
-	return 1;
+	return ret;
 }
 
 /* Simple linked list for keeping track of mappings in test_guard_gap() */
-- 
2.43.0

Re: [PATCH] selftests/x86: Fix userfaultfd test for shadow stack rejection

[David Hildenbrand (Arm)]

On 10/19/26 03:03, Ning, Hongyu wrote:
> Commit 3c58f641e813 ("userfaultfd: prevent registration of special
> VMAs") prevents userfaultfd registration on shadow stack VMAs to avoid
> bypassing shadow stack protections through UFFDIO_COPY.
> 
> The existing shadow stack selftest still expects UFFDIO_REGISTER to
> succeed and uses UFFDIO_COPY to populate the shadow stack. This causes
> the selftest to fail on Kernels containing this security fix.
> 
> Update the selftest to verify that UFFDIO_REGISTER rejects shadow stack
> VMAs with EINVAL. Remove the obsolete userfaultfd fault handling thread
> and UFFDIO_COPY test path.
> 
> Tested on: Intel shadow stack capable x86_64 platform
> 
> Before fix:
> 	[FAIL]  Userfaultfd test with return code 1
> 
> After fix:
> 	[OK]    Userfaultfd rejects shadow stack registration (EINVAL)


Interesting, so we wouldn't be able to snapshot+restore an app that uses shadow
stacks.

@Mike: I assume that's not a concern for CRIU etc, right?

> 
> Fixes: 3c58f641e813 ("userfaultfd: prevent registration of special VMAs")
> 
> Signed-off-by: Hongyu Ning <hongyu.ning@linux.intel.com>
Acked-by: David Hildenbrand (Arm) <david@kernel.org>

-- 
Cheers,

David

Re: [PATCH] selftests/x86: Fix userfaultfd test for shadow stack rejection

[Mike Rapoport]

On Mon, Oct 19, 2026 at 03:03:43PM +0200, David Hildenbrand (Arm) wrote:
> On 10/19/26 03:03, Ning, Hongyu wrote:
> > Commit 3c58f641e813 ("userfaultfd: prevent registration of special
> > VMAs") prevents userfaultfd registration on shadow stack VMAs to avoid
> > bypassing shadow stack protections through UFFDIO_COPY.
> > 
> > The existing shadow stack selftest still expects UFFDIO_REGISTER to
> > succeed and uses UFFDIO_COPY to populate the shadow stack. This causes
> > the selftest to fail on Kernels containing this security fix.
> > 
> > Update the selftest to verify that UFFDIO_REGISTER rejects shadow stack
> > VMAs with EINVAL. Remove the obsolete userfaultfd fault handling thread
> > and UFFDIO_COPY test path.
> > 
> > Tested on: Intel shadow stack capable x86_64 platform
> > 
> > Before fix:
> > 	[FAIL]  Userfaultfd test with return code 1
> > 
> > After fix:
> > 	[OK]    Userfaultfd rejects shadow stack registration (EINVAL)
> 
> 
> Interesting, so we wouldn't be able to snapshot+restore an app that uses shadow
> stacks.
> 
> @Mike: I assume that's not a concern for CRIU etc, right?

CRIU can do snapshots without uffd and it can do shadow stacks in its own
inventive way :)
 
> > 
> > Fixes: 3c58f641e813 ("userfaultfd: prevent registration of special VMAs")
> > 
> > Signed-off-by: Hongyu Ning <hongyu.ning@linux.intel.com>
> Acked-by: David Hildenbrand (Arm) <david@kernel.org>
> 
> -- 
> Cheers,
> 
> David

-- 
Sincerely yours,
Mike.

Re: [PATCH] selftests/x86: Fix userfaultfd test for shadow stack rejection

[Mike Rapoport]

On Mon, Oct 19, 2026 at 09:03:12AM +0800, Ning, Hongyu wrote:
> Commit 3c58f641e813 ("userfaultfd: prevent registration of special
> VMAs") prevents userfaultfd registration on shadow stack VMAs to avoid
> bypassing shadow stack protections through UFFDIO_COPY.
> 
> The existing shadow stack selftest still expects UFFDIO_REGISTER to
> succeed and uses UFFDIO_COPY to populate the shadow stack. This causes
> the selftest to fail on Kernels containing this security fix.
> 
> Update the selftest to verify that UFFDIO_REGISTER rejects shadow stack
> VMAs with EINVAL. Remove the obsolete userfaultfd fault handling thread
> and UFFDIO_COPY test path.
> 
> Tested on: Intel shadow stack capable x86_64 platform
> 
> Before fix:
> 	[FAIL]  Userfaultfd test with return code 1
> 
> After fix:
> 	[OK]    Userfaultfd rejects shadow stack registration (EINVAL)
> 
> Fixes: 3c58f641e813 ("userfaultfd: prevent registration of special VMAs")
> 
> Signed-off-by: Hongyu Ning <hongyu.ning@linux.intel.com>

Acked-by: Mike Rapoport (Microsoft) <rppt@kernel.org>

> ChatGPT was used to assist with root-cause analysis and patch
> preparation. The changes were reviewed and validated on Intel shadow
> stack capable x86_64 platform, with all 12 shadow stack tests passing.
> ---
>  .../testing/selftests/x86/test_shadow_stack.c | 105 ++++++------------
>  1 file changed, 34 insertions(+), 71 deletions(-)

-- 
Sincerely yours,
Mike.