* [PATCH 1/4] arm64/gcs: release GCS on failed fork
2026-10-16 19:45 [PATCH 0/4] arm64, riscv: release shadow stacks on failed fork Iván Ezequiel Rodriguez
@ 2026-10-16 19:46 ` Iván Ezequiel Rodriguez
2026-10-16 19:46 ` [PATCH 2/4] riscv/shstk: release shadow stack " Iván Ezequiel Rodriguez
` (2 subsequent siblings)
3 siblings, 0 replies; 5+ messages in thread
From: Iván Ezequiel Rodriguez @ 2026-10-16 19:46 UTC (permalink / raw)
To: Catalin Marinas, Will Deacon, Paul Walmsley, Palmer Dabbelt,
linux-arm-kernel, linux-riscv
Cc: linux-kernel, linux-kselftest, Mark Rutland, Mark Brown,
Deepak Gupta, Alexandre Ghiti, Albert Ou, Shuah Khan,
Christian Brauner, James Morse, Yury Khrustalev,
Thiago Jung Bauermann, Samuel Holland, Zong Li, Charlie Jenkins,
Shaopeng Tan, Zishun Yi, Peter Zijlstra (Intel),
stable
copy_thread() maps a GCS for a CLONE_VM child and can still return
0. A later copy_process() failure then goes through
bad_fork_cleanup_thread, which calls exit_thread(). The hole this
series hits is clone3(CLONE_VM|CLONE_PIDFD) when put_user() of the
pidfd fails after that mapping. arm64 did not implement
exit_thread(). deactivate_mm() is what normally calls gcs_free(),
and it does not run on this path. Each rejected clone leaves one
GCS VMA in the parent's mm until the mm dies.
Select HAVE_EXIT_THREAD and free the child's GCS from
exit_thread(). gcs_free() already ignores a cleared base and a
different mm, so the usual exit path (deactivate_mm() then this) is
a no-op the second time. copy_thread_gcs() zeros the inherited
tracking before a user-thread allocation, so an allocation error
still skips exit_thread() with nothing to unmap.
A kthread copies the caller's GCS fields via arch_dup_task_struct().
kernel_thread() uses CLONE_VM, so during a failed copy_process()
the child still shares the caller's mm and gcs_free()'s mm check
does not save us. Clear the inherited tracking as part of kthread
setup.
Tested with CONFIG_ARM64_GCS on QEMU 11.1.2 -machine virt -cpu max.
Sixteen clone3() calls with CLONE_VM|CLONE_PIDFD and an unwritable
pidfd pointer leaked 16 GCS VMAs without the fix. With it, the VMA
count was unchanged and call/return on the parent still used the
original GCS. A successful clone3 child exit with the same flags
runs deactivate_mm() and then exit_thread().
Fixes: 506496bcbb42 ("arm64/gcs: Ensure that new threads have a GCS")
Cc: stable@vger.kernel.org
Cc: Mark Brown <broonie@kernel.org>
Assisted-by: LLM
Signed-off-by: Iván Ezequiel Rodriguez <ivanrwcm25@gmail.com>
---
arch/arm64/Kconfig | 1 +
arch/arm64/kernel/process.c | 21 +++++++++++++++++++++
2 files changed, 22 insertions(+)
diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig
index cab741a695f5..c7fc79409f98 100644
--- a/arch/arm64/Kconfig
+++ b/arch/arm64/Kconfig
@@ -177,6 +177,7 @@ config ARM64
select HAVE_ARM_SMCCC
select HAVE_ASM_MODVERSIONS
select HAVE_EBPF_JIT
+ select HAVE_EXIT_THREAD
select HAVE_C_RECORDMCOUNT
select HAVE_CMPXCHG_DOUBLE
select HAVE_CMPXCHG_LOCAL
diff --git a/arch/arm64/kernel/process.c b/arch/arm64/kernel/process.c
index 581f80e9b9b7..eb5314b4b42b 100644
--- a/arch/arm64/kernel/process.c
+++ b/arch/arm64/kernel/process.c
@@ -341,6 +341,16 @@ void flush_thread(void)
flush_gcs();
}
+void exit_thread(struct task_struct *tsk)
+{
+ /*
+ * copy_process() calls this after copy_thread() returns 0.
+ * deactivate_mm() does not run on that failure path.
+ * gcs_free() is a no-op once gcs_base is cleared.
+ */
+ gcs_free(tsk);
+}
+
void arch_release_task_struct(struct task_struct *tsk)
{
fpsimd_release_task(tsk);
@@ -503,6 +513,17 @@ int copy_thread(struct task_struct *p, const struct kernel_clone_args *args)
p->thread.cpu_context.x19 = (unsigned long)args->fn;
p->thread.cpu_context.x20 = (unsigned long)args->fn_arg;
+#ifdef CONFIG_ARM64_GCS
+ /*
+ * kernel_thread() uses CLONE_VM, so a failed
+ * copy_process() still shares the caller's mm.
+ * Inherited GCS tracking would then look like a
+ * child mapping to gcs_free().
+ */
+ p->thread.gcs_base = 0;
+ p->thread.gcs_size = 0;
+ p->thread.gcspr_el0 = 0;
+#endif
if (system_supports_poe())
p->thread.por_el0 = POR_EL0_INIT;
--
2.43.0
^ permalink raw reply [flat|nested] 5+ messages in thread* [PATCH 2/4] riscv/shstk: release shadow stack on failed fork
2026-10-16 19:45 [PATCH 0/4] arm64, riscv: release shadow stacks on failed fork Iván Ezequiel Rodriguez
2026-10-16 19:46 ` [PATCH 1/4] arm64/gcs: release GCS " Iván Ezequiel Rodriguez
@ 2026-10-16 19:46 ` Iván Ezequiel Rodriguez
2026-10-16 19:46 ` [PATCH 3/4] selftests/arm64: GCS must not leak on a failed clone3 Iván Ezequiel Rodriguez
2026-10-16 19:46 ` [PATCH 4/4] selftests/riscv: shadow stack " Iván Ezequiel Rodriguez
3 siblings, 0 replies; 5+ messages in thread
From: Iván Ezequiel Rodriguez @ 2026-10-16 19:46 UTC (permalink / raw)
To: Catalin Marinas, Will Deacon, Paul Walmsley, Palmer Dabbelt,
linux-arm-kernel, linux-riscv
Cc: linux-kernel, linux-kselftest, Mark Rutland, Mark Brown,
Deepak Gupta, Alexandre Ghiti, Albert Ou, Shuah Khan,
Christian Brauner, James Morse, Yury Khrustalev,
Thiago Jung Bauermann, Samuel Holland, Zong Li, Charlie Jenkins,
Shaopeng Tan, Zishun Yi, Peter Zijlstra (Intel),
stable
copy_thread() maps a shadow stack for a CLONE_VM child and can still
return 0. A later copy_process() failure, including clone3()
CLONE_PIDFD when put_user() fails, goes through
bad_fork_cleanup_thread and exit_thread(). riscv did not select
HAVE_EXIT_THREAD, so that free was a no-op. shstk_release() already
documents this call; deactivate_mm() is the only path that actually
reached it.
Select HAVE_EXIT_THREAD and call shstk_release() from
exit_thread(). The helper already refuses a different mm and a
cleared base, so CLONE_VFORK, !CLONE_VM, and a second call after
deactivate_mm() stay no-ops.
Do not free when shstk_alloc_thread_stack() fails. That error
returns from copy_thread() with the inherited parent base still in
place, and copy_process() skips exit_thread() on that path.
A kthread copies the caller's tracking via arch_dup_task_struct().
kernel_thread() uses CLONE_VM, so during a failed copy_process()
the child still shares the caller's mm and shstk_release()'s mm
check does not save us. Clear the inherited tracking as part of
kthread setup.
Fixes: fd44a4a85516 ("riscv/shstk: If needed allocate a new shadow stack on clone")
Cc: stable@vger.kernel.org
Cc: Deepak Gupta <debug@rivosinc.com>
Assisted-by: LLM
Signed-off-by: Iván Ezequiel Rodriguez <ivanrwcm25@gmail.com>
---
arch/riscv/Kconfig | 1 +
arch/riscv/kernel/process.c | 18 ++++++++++++++++++
2 files changed, 19 insertions(+)
diff --git a/arch/riscv/Kconfig b/arch/riscv/Kconfig
index 5874ca30f4f6..7635f8cb0397 100644
--- a/arch/riscv/Kconfig
+++ b/arch/riscv/Kconfig
@@ -169,6 +169,7 @@ config RISCV
select HAVE_FUNCTION_GRAPH_FREGS
select HAVE_FUNCTION_TRACER if HAVE_DYNAMIC_FTRACE
select HAVE_EBPF_JIT if MMU
+ select HAVE_EXIT_THREAD
select HAVE_GENERIC_TIF_BITS
select HAVE_GUP_FAST if MMU
select HAVE_FUNCTION_ARG_ACCESS_API
diff --git a/arch/riscv/kernel/process.c b/arch/riscv/kernel/process.c
index 7cc5a6a5c020..def1f520d9ef 100644
--- a/arch/riscv/kernel/process.c
+++ b/arch/riscv/kernel/process.c
@@ -12,6 +12,7 @@
#include <linux/kernel.h>
#include <linux/sched.h>
#include <linux/sched/debug.h>
+#include <linux/sched/task.h>
#include <linux/sched/task_stack.h>
#include <linux/tick.h>
#include <linux/ptrace.h>
@@ -213,6 +214,16 @@ void arch_release_task_struct(struct task_struct *tsk)
riscv_v_thread_free(tsk);
}
+void exit_thread(struct task_struct *tsk)
+{
+ /*
+ * shstk_release() documents this call for a failed CLONE_VM
+ * clone. copy_process() reaches it only after copy_thread()
+ * returns 0; deactivate_mm() does not run on that path.
+ */
+ shstk_release(tsk);
+}
+
int arch_dup_task_struct(struct task_struct *dst, struct task_struct *src)
{
fstate_save(src, task_pt_regs(src));
@@ -261,6 +272,13 @@ int copy_thread(struct task_struct *p, const struct kernel_clone_args *args)
p->thread.s[0] = (unsigned long)args->fn;
p->thread.s[1] = (unsigned long)args->fn_arg;
p->thread.ra = (unsigned long)ret_from_fork_kernel_asm;
+ /*
+ * kernel_thread() uses CLONE_VM, so a failed
+ * copy_process() still shares the caller's mm.
+ * Inherited tracking would then look like a child
+ * mapping to shstk_release().
+ */
+ set_shstk_base(p, 0, 0);
} else {
/* allocate new shadow stack if needed. In case of CLONE_VM we have to */
ssp = shstk_alloc_thread_stack(p, args);
--
2.43.0
^ permalink raw reply [flat|nested] 5+ messages in thread* [PATCH 3/4] selftests/arm64: GCS must not leak on a failed clone3
2026-10-16 19:45 [PATCH 0/4] arm64, riscv: release shadow stacks on failed fork Iván Ezequiel Rodriguez
2026-10-16 19:46 ` [PATCH 1/4] arm64/gcs: release GCS " Iván Ezequiel Rodriguez
2026-10-16 19:46 ` [PATCH 2/4] riscv/shstk: release shadow stack " Iván Ezequiel Rodriguez
@ 2026-10-16 19:46 ` Iván Ezequiel Rodriguez
2026-10-16 19:46 ` [PATCH 4/4] selftests/riscv: shadow stack " Iván Ezequiel Rodriguez
3 siblings, 0 replies; 5+ messages in thread
From: Iván Ezequiel Rodriguez @ 2026-10-16 19:46 UTC (permalink / raw)
To: Catalin Marinas, Will Deacon, Paul Walmsley, Palmer Dabbelt,
linux-arm-kernel, linux-riscv
Cc: linux-kernel, linux-kselftest, Mark Rutland, Mark Brown,
Deepak Gupta, Alexandre Ghiti, Albert Ou, Shuah Khan,
Christian Brauner, James Morse, Yury Khrustalev,
Thiago Jung Bauermann, Samuel Holland, Zong Li, Charlie Jenkins,
Shaopeng Tan, Zishun Yi, Peter Zijlstra (Intel)
clone3(CLONE_VM|CLONE_PIDFD) with an unwritable pidfd pointer fails
in put_user() after copy_thread() has mapped a GCS. copy_process()
then calls exit_thread(). Without HAVE_EXIT_THREAD that free is a
no-op and the VMA stays in the parent's mm.
Enable GCS, reject 16 such clones, and require the shadow-stack VMA
count to stay unchanged. The original mapping must remain, and a
call/return on that stack must succeed, so the cleanup cannot be
unmapping the parent's GCS.
A clone3 with the same flags and a valid pidfd has to succeed first
and write a pidfd. That child exits normally, so deactivate_mm()
and exit_thread() both run. ENOSYS, EINVAL, and EPERM skip; any
other error from that clone, or a success that leaves pidfd unset,
fails the test. The rejected child's empty GCS is left with a raw
exit syscall.
Skip when HWCAP has no GCS, or when the kernel returns EOPNOTSUPP,
EINVAL, or EBUSY. Any other PR_SET_SHADOW_STACK_STATUS error fails
the test. The test expects /proc already mounted, as in a normal
kselftest run.
The prctl wrapper matches gcs-locking.c. The recursive call goes
through an indirect call; a visible recursive body is optimized
into a closed form and does not execute a BL/RET.
Assisted-by: LLM
Signed-off-by: Iván Ezequiel Rodriguez <ivanrwcm25@gmail.com>
---
tools/testing/selftests/arm64/gcs/Makefile | 3 +-
.../selftests/arm64/gcs/gcs-clone-pidfd.c | 355 ++++++++++++++++++
2 files changed, 357 insertions(+), 1 deletion(-)
create mode 100644 tools/testing/selftests/arm64/gcs/gcs-clone-pidfd.c
diff --git a/tools/testing/selftests/arm64/gcs/Makefile b/tools/testing/selftests/arm64/gcs/Makefile
index 1fbbf0ca1f02..f1365eea31c9 100644
--- a/tools/testing/selftests/arm64/gcs/Makefile
+++ b/tools/testing/selftests/arm64/gcs/Makefile
@@ -6,7 +6,8 @@
# nolibc.
#
-TEST_GEN_PROGS := basic-gcs libc-gcs gcs-locking gcs-stress gcspushm gcsstr
+TEST_GEN_PROGS := basic-gcs libc-gcs gcs-locking gcs-stress gcspushm gcsstr \
+ gcs-clone-pidfd
TEST_GEN_PROGS_EXTENDED := gcs-stress-thread
LDLIBS+=-lpthread
diff --git a/tools/testing/selftests/arm64/gcs/gcs-clone-pidfd.c b/tools/testing/selftests/arm64/gcs/gcs-clone-pidfd.c
new file mode 100644
index 000000000000..c8515e65c947
--- /dev/null
+++ b/tools/testing/selftests/arm64/gcs/gcs-clone-pidfd.c
@@ -0,0 +1,355 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * clone3(CLONE_VM|CLONE_PIDFD) with an unwritable pidfd pointer must
+ * not leak a GCS VMA. copy_thread() maps one, then put_user() fails
+ * and copy_process() calls exit_thread(). Without HAVE_EXIT_THREAD
+ * that free is a no-op and the VMA stays in the parent's mm.
+ *
+ * Pass: shadow-stack VMA count is unchanged, the original mapping is
+ * still there, and a call/return on this thread still works.
+ * Fail: one new shadow-stack VMA per rejected clone.
+ *
+ * Enable GCS with an inlined prctl. A libc return across that point
+ * has no address on the GCS, so main() must not return after enable.
+ */
+#define _GNU_SOURCE
+
+#include <errno.h>
+#include <linux/sched.h>
+#include <sched.h>
+#include <signal.h>
+#include <stdint.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <sys/auxv.h>
+#include <sys/mman.h>
+#include <sys/syscall.h>
+#include <sys/wait.h>
+#include <unistd.h>
+
+#include <asm/hwcap.h>
+
+#include "gcs-util.h"
+
+#ifndef HWCAP_GCS
+#define HWCAP_GCS (1UL << 32)
+#endif
+
+#ifndef __NR_clone3
+#define __NR_clone3 435
+#endif
+
+/* Same value as KSFT_SKIP in kselftest.h. */
+#define KSFT_SKIP 4
+
+#define NCLONE 16
+#define STACK_SIZE (64 * 1024)
+
+/* Same wrapper as gcs-locking.c: extra prctl args must be zero. */
+#define my_syscall2(num, arg1, arg2) \
+({ \
+ register long _num __asm__ ("x8") = (num); \
+ register long _arg1 __asm__ ("x0") = (long)(arg1); \
+ register long _arg2 __asm__ ("x1") = (long)(arg2); \
+ register long _arg3 __asm__ ("x2") = 0; \
+ register long _arg4 __asm__ ("x3") = 0; \
+ register long _arg5 __asm__ ("x4") = 0; \
+ \
+ __asm__ volatile ( \
+ "svc #0\n" \
+ : "=r"(_arg1) \
+ : "r"(_arg1), "r"(_arg2), \
+ "r"(_arg3), "r"(_arg4), \
+ "r"(_arg5), "r"(_num) \
+ : "memory", "cc" \
+ ); \
+ _arg1; \
+})
+
+static void on_fault(int sig)
+{
+ static const char msg[] = "[FAIL]\tparent guarded control stack faulted\n";
+
+ (void)sig;
+ if (write(2, msg, sizeof(msg) - 1) < 0)
+ _exit(2);
+ _exit(2);
+}
+
+struct ss_span {
+ unsigned long start;
+ unsigned long end;
+};
+
+static void ss_scan(int *vmas, int *kb, unsigned long addr, struct ss_span *hit,
+ const struct ss_span *want, int *kept)
+{
+ FILE *f;
+ char line[256];
+ unsigned long start = 0, end = 0;
+ int size = 0;
+ int saw_size = 0;
+
+ *vmas = 0;
+ *kb = 0;
+ if (hit) {
+ hit->start = 0;
+ hit->end = 0;
+ }
+ if (kept)
+ *kept = 0;
+ f = fopen("/proc/self/smaps", "r");
+ if (!f) {
+ perror("smaps");
+ _exit(1);
+ }
+ while (fgets(line, sizeof(line), f)) {
+ unsigned long a, b;
+
+ if (sscanf(line, "%lx-%lx", &a, &b) == 2) {
+ start = a;
+ end = b;
+ saw_size = 0;
+ continue;
+ }
+ if (sscanf(line, "Size: %d kB", &size) == 1) {
+ saw_size = 1;
+ continue;
+ }
+ if (strncmp(line, "VmFlags:", 8) || !saw_size)
+ continue;
+ if (!strstr(line, " ss")) {
+ saw_size = 0;
+ continue;
+ }
+ (*vmas)++;
+ *kb += size;
+ /*
+ * An empty GCS leaves GCSPR at the exclusive end. If
+ * the next VMA is contiguous that address is also the
+ * start of the next range; prefer the mapping that
+ * ends here.
+ */
+ if (hit && addr == end) {
+ hit->start = start;
+ hit->end = end;
+ } else if (hit && !hit->start && addr >= start && addr < end) {
+ hit->start = start;
+ hit->end = end;
+ }
+ if (kept && want && start == want->start && end == want->end)
+ *kept = 1;
+ saw_size = 0;
+ }
+ fclose(f);
+}
+
+/*
+ * CLONE_VM maps a new GCS. CLONE_PIDFD lets put_user() fail after that.
+ * No CLONE_THREAD: a created child is a separate process. The child
+ * resumes on an empty GCS, so it must not return into libc.
+ */
+static int clone_pidfd(void *stack, size_t stack_size, int *pidfd_ptr)
+{
+ struct clone_args args = {
+ .flags = CLONE_VM | CLONE_PIDFD,
+ .pidfd = (uint64_t)(uintptr_t)pidfd_ptr,
+ .exit_signal = SIGCHLD,
+ .stack = (uint64_t)(uintptr_t)stack,
+ .stack_size = stack_size,
+ };
+ register long num __asm__("x8") = __NR_clone3;
+ register long ret __asm__("x0") = (long)&args;
+ register long sz __asm__("x1") = sizeof(args);
+ int st;
+
+ asm volatile("svc #0"
+ : "+r"(ret)
+ : "r"(num), "r"(sz)
+ : "memory", "cc");
+ if (ret == 0) {
+ register long n __asm__("x8") = __NR_exit;
+ register long e __asm__("x0") = 0;
+
+ asm volatile("svc #0" : : "r"(n), "r"(e) : "memory");
+ __builtin_unreachable();
+ }
+ if (ret < 0)
+ return ret;
+ if (waitpid((pid_t)ret, &st, 0) < 0)
+ return -errno;
+ if (!WIFEXITED(st) || WEXITSTATUS(st) != 0)
+ return 1;
+ return 0;
+}
+
+/*
+ * GCC can fold a visible recursive body. Hide the callee in an asm
+ * output so each level stays a real BL/RET that uses the GCS.
+ */
+static int depth(int n);
+static int (*depth_fn)(int) = depth;
+
+static int depth(int n)
+{
+ int (*go)(int n);
+
+ if (n <= 0)
+ return 1;
+ asm volatile("" : "=r"(go) : "0"(depth_fn) : "memory");
+ return go(n - 1) + 1;
+}
+
+static int skip_enable(long rc)
+{
+ if (rc == -EOPNOTSUPP) {
+ printf("[SKIP]\tkernel has no GCS\n");
+ } else if (rc == -EINVAL) {
+ printf("[SKIP]\tkernel built without GCS\n");
+ } else if (rc == -EBUSY) {
+ printf("[SKIP]\tGCS is locked\n");
+ } else {
+ printf("[FAIL]\tPR_SET_SHADOW_STACK_STATUS returned %ld\n", rc);
+ return 1;
+ }
+ return KSFT_SKIP;
+}
+
+int main(void)
+{
+ struct sigaction sa;
+ struct ss_span parent;
+ void *stack;
+ void *bad_pidfd;
+ unsigned long gcspr, gcspr_mid;
+ unsigned long gcs_mode;
+ long rc;
+ int pidfd;
+ int vmas0, kb0, vmas1, kb1;
+ int i, kept, d, cret;
+
+ setbuf(stdout, NULL);
+
+ if (!(getauxval(AT_HWCAP) & HWCAP_GCS)) {
+ printf("[SKIP]\tHWCAP has no GCS\n");
+ return KSFT_SKIP;
+ }
+
+ stack = mmap(NULL, STACK_SIZE, PROT_READ | PROT_WRITE,
+ MAP_PRIVATE | MAP_ANONYMOUS | MAP_STACK, -1, 0);
+ if (stack == MAP_FAILED) {
+ perror("mmap stack");
+ return 1;
+ }
+ bad_pidfd = mmap(NULL, 4096, PROT_NONE,
+ MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
+ if (bad_pidfd == MAP_FAILED) {
+ perror("mmap pidfd");
+ return 1;
+ }
+
+ rc = my_syscall2(__NR_prctl, PR_GET_SHADOW_STACK_STATUS, &gcs_mode);
+ if (rc) {
+ printf("[FAIL]\tPR_GET_SHADOW_STACK_STATUS returned %ld\n", rc);
+ return 1;
+ }
+ if (!(gcs_mode & PR_SHADOW_STACK_ENABLE)) {
+ rc = my_syscall2(__NR_prctl, PR_SET_SHADOW_STACK_STATUS,
+ PR_SHADOW_STACK_ENABLE);
+ if (rc)
+ return skip_enable(rc);
+ }
+
+ gcspr = (unsigned long)get_gcspr();
+ if (!gcspr) {
+ printf("[FAIL]\tenable left GCSPR_EL0 at 0\n");
+ _exit(1);
+ }
+
+ pidfd = -1;
+ cret = clone_pidfd(stack, STACK_SIZE, &pidfd);
+ if (cret == -ENOSYS || cret == -EINVAL || cret == -EPERM) {
+ printf("[SKIP]\tclone3 with a valid pidfd failed: %s\n",
+ strerror(-cret));
+ _exit(KSFT_SKIP);
+ }
+ if (cret < 0) {
+ printf("[FAIL]\tclone3 with a valid pidfd failed: %s\n",
+ strerror(-cret));
+ _exit(1);
+ }
+ if (cret) {
+ printf("[FAIL]\tclone3 with a valid pidfd did not exit 0\n");
+ _exit(1);
+ }
+ if (pidfd < 0) {
+ printf("[FAIL]\tclone3 succeeded but did not write a pidfd\n");
+ _exit(1);
+ }
+ close(pidfd);
+
+ memset(&sa, 0, sizeof(sa));
+ sa.sa_handler = on_fault;
+ if (sigaction(SIGSEGV, &sa, NULL) || sigaction(SIGBUS, &sa, NULL)) {
+ perror("sigaction");
+ _exit(1);
+ }
+
+ gcspr = (unsigned long)get_gcspr();
+ ss_scan(&vmas0, &kb0, gcspr, &parent, NULL, NULL);
+ if (!parent.start) {
+ printf("[FAIL]\tGCSPR %lx matches no shadow-stack VMA\n", gcspr);
+ _exit(1);
+ }
+
+ for (i = 0; i < NCLONE; i++) {
+ cret = clone_pidfd(stack, STACK_SIZE, bad_pidfd);
+ if (cret == -EFAULT)
+ continue;
+ if (cret < 0)
+ printf("[FAIL]\tbad pidfd errno %d, want EFAULT\n",
+ -cret);
+ else
+ printf("[FAIL]\tbad pidfd was accepted\n");
+ _exit(1);
+ }
+
+ ss_scan(&vmas1, &kb1, 0, NULL, &parent, &kept);
+ gcspr_mid = (unsigned long)get_gcspr();
+ d = -1;
+ if (kept && gcspr_mid)
+ d = depth(16);
+ gcspr = (unsigned long)get_gcspr();
+
+ printf("ss_vmas=%d->%d delta=%d ss_kb=%d->%d\n",
+ vmas0, vmas1, vmas1 - vmas0, kb0, kb1);
+ printf("parent=%lx-%lx kept=%d gcspr_before_depth=%lx depth=%d gcspr=%lx\n",
+ parent.start, parent.end, kept, gcspr_mid, d, gcspr);
+
+ if (vmas1 != vmas0 || kb1 != kb0) {
+ printf("[FAIL]\tleaked %d shadow-stack VMA(s), %d kB\n",
+ vmas1 - vmas0, kb1 - kb0);
+ _exit(1);
+ }
+ if (!kept) {
+ printf("[FAIL]\tparent GCS %lx-%lx was unmapped\n",
+ parent.start, parent.end);
+ _exit(2);
+ }
+ if (!gcspr_mid) {
+ printf("[FAIL]\tparent GCSPR was 0 before call/return\n");
+ _exit(2);
+ }
+ if (d != 17) {
+ printf("[FAIL]\tparent call/return returned %d, want 17\n", d);
+ _exit(2);
+ }
+ if (!gcspr) {
+ printf("[FAIL]\tparent GCSPR is 0 after call/return\n");
+ _exit(2);
+ }
+
+ printf("[OK]\tno GCS VMA leak; parent stack still works\n");
+ _exit(0);
+}
--
2.43.0
^ permalink raw reply [flat|nested] 5+ messages in thread* [PATCH 4/4] selftests/riscv: shadow stack must not leak on a failed clone3
2026-10-16 19:45 [PATCH 0/4] arm64, riscv: release shadow stacks on failed fork Iván Ezequiel Rodriguez
` (2 preceding siblings ...)
2026-10-16 19:46 ` [PATCH 3/4] selftests/arm64: GCS must not leak on a failed clone3 Iván Ezequiel Rodriguez
@ 2026-10-16 19:46 ` Iván Ezequiel Rodriguez
3 siblings, 0 replies; 5+ messages in thread
From: Iván Ezequiel Rodriguez @ 2026-10-16 19:46 UTC (permalink / raw)
To: Catalin Marinas, Will Deacon, Paul Walmsley, Palmer Dabbelt,
linux-arm-kernel, linux-riscv
Cc: linux-kernel, linux-kselftest, Mark Rutland, Mark Brown,
Deepak Gupta, Alexandre Ghiti, Albert Ou, Shuah Khan,
Christian Brauner, James Morse, Yury Khrustalev,
Thiago Jung Bauermann, Samuel Holland, Zong Li, Charlie Jenkins,
Shaopeng Tan, Zishun Yi, Peter Zijlstra (Intel)
clone3(CLONE_VM|CLONE_PIDFD) with an unwritable pidfd pointer fails
in put_user() after copy_thread() has mapped a shadow stack.
copy_process() then calls exit_thread(). Without HAVE_EXIT_THREAD
that free is a no-op and the VMA stays in the parent's mm.
Enable user shadow stack, reject 16 such clones, and require the
shadow-stack VMA count to stay unchanged. The original mapping must
remain, and a call/return on that stack must succeed, so the cleanup
cannot be unmapping the parent's shadow stack.
A clone3 with the same flags and a valid pidfd has to succeed first
and write a pidfd. That child exits normally, so deactivate_mm()
and exit_thread() both run. ENOSYS, EINVAL, and EPERM skip; any
other error from that clone, or a success that leaves pidfd unset,
fails the test. The rejected child's empty shadow stack is left
with a raw exit syscall.
Skip when the kernel returns EOPNOTSUPP or EINVAL, or when the
feature is locked. The test expects /proc already mounted, as in a
normal kselftest run. The toolchain CFLAGS already request
zicfiss/zicfilp; the Makefile skips this binary when the compiler
cannot target them.
Assisted-by: LLM
Signed-off-by: Iván Ezequiel Rodriguez <ivanrwcm25@gmail.com>
---
tools/testing/selftests/riscv/cfi/Makefile | 5 +-
.../selftests/riscv/cfi/shstk-clone-pidfd.c | 317 ++++++++++++++++++
2 files changed, 321 insertions(+), 1 deletion(-)
create mode 100644 tools/testing/selftests/riscv/cfi/shstk-clone-pidfd.c
diff --git a/tools/testing/selftests/riscv/cfi/Makefile b/tools/testing/selftests/riscv/cfi/Makefile
index 418b4b5325a5..dbecb1fd3b82 100644
--- a/tools/testing/selftests/riscv/cfi/Makefile
+++ b/tools/testing/selftests/riscv/cfi/Makefile
@@ -13,10 +13,13 @@ endif
ifeq ($(shell $(CC) $(CFLAGS) -nostdlib -xc /dev/null -o /dev/null > /dev/null 2>&1; echo $$?),0)
-TEST_GEN_PROGS := cfitests
+TEST_GEN_PROGS := cfitests shstk-clone-pidfd
$(OUTPUT)/cfitests: cfitests.c shadowstack.c
$(CC) -o $@ $(CFLAGS) $(LDFLAGS) $^
+
+$(OUTPUT)/shstk-clone-pidfd: shstk-clone-pidfd.c
+ $(CC) -o $@ $(CFLAGS) $(LDFLAGS) $^
else
$(shell echo "Toolchain doesn't support CFI, skipping CFI kselftest." >&2)
diff --git a/tools/testing/selftests/riscv/cfi/shstk-clone-pidfd.c b/tools/testing/selftests/riscv/cfi/shstk-clone-pidfd.c
new file mode 100644
index 000000000000..3f9f6827bd4d
--- /dev/null
+++ b/tools/testing/selftests/riscv/cfi/shstk-clone-pidfd.c
@@ -0,0 +1,317 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * clone3(CLONE_VM|CLONE_PIDFD) with an unwritable pidfd pointer must
+ * not leak a shadow-stack VMA. copy_thread() maps one, then put_user()
+ * fails and copy_process() calls exit_thread(). Without HAVE_EXIT_THREAD
+ * that free is a no-op and the VMA stays in the parent's mm.
+ *
+ * Enable shadow stack with an inlined prctl. A libc return across that
+ * point has no address on the shadow stack, so main() must not return
+ * after enable.
+ */
+#define _GNU_SOURCE
+
+#include <errno.h>
+#include <linux/prctl.h>
+#include <linux/sched.h>
+#include <sched.h>
+#include <signal.h>
+#include <stdint.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <sys/mman.h>
+#include <sys/syscall.h>
+#include <sys/wait.h>
+#include <unistd.h>
+
+#include "cfi_rv_test.h"
+
+#ifndef __NR_clone3
+#define __NR_clone3 435
+#endif
+
+#ifndef PR_GET_SHADOW_STACK_STATUS
+#define PR_GET_SHADOW_STACK_STATUS 74
+#endif
+#ifndef PR_SET_SHADOW_STACK_STATUS
+#define PR_SET_SHADOW_STACK_STATUS 75
+#endif
+#ifndef PR_SHADOW_STACK_ENABLE
+#define PR_SHADOW_STACK_ENABLE (1UL << 0)
+#endif
+
+#define KSFT_SKIP 4
+#define NCLONE 16
+#define STACK_SIZE (64 * 1024)
+
+static void on_fault(int sig)
+{
+ static const char msg[] = "[FAIL]\tparent shadow stack faulted\n";
+
+ (void)sig;
+ if (write(2, msg, sizeof(msg) - 1) < 0)
+ _exit(2);
+ _exit(2);
+}
+
+struct ss_span {
+ unsigned long start;
+ unsigned long end;
+};
+
+static void ss_scan(int *vmas, int *kb, unsigned long addr, struct ss_span *hit,
+ const struct ss_span *want, int *kept)
+{
+ FILE *f;
+ char line[256];
+ unsigned long start = 0, end = 0;
+ int size = 0;
+ int saw_size = 0;
+
+ *vmas = 0;
+ *kb = 0;
+ if (hit) {
+ hit->start = 0;
+ hit->end = 0;
+ }
+ if (kept)
+ *kept = 0;
+ f = fopen("/proc/self/smaps", "r");
+ if (!f) {
+ perror("smaps");
+ _exit(1);
+ }
+ while (fgets(line, sizeof(line), f)) {
+ unsigned long a, b;
+
+ if (sscanf(line, "%lx-%lx", &a, &b) == 2) {
+ start = a;
+ end = b;
+ saw_size = 0;
+ continue;
+ }
+ if (sscanf(line, "Size: %d kB", &size) == 1) {
+ saw_size = 1;
+ continue;
+ }
+ if (strncmp(line, "VmFlags:", 8) || !saw_size)
+ continue;
+ if (!strstr(line, " ss")) {
+ saw_size = 0;
+ continue;
+ }
+ (*vmas)++;
+ *kb += size;
+ if (hit && addr == end) {
+ hit->start = start;
+ hit->end = end;
+ } else if (hit && !hit->start && addr >= start && addr < end) {
+ hit->start = start;
+ hit->end = end;
+ }
+ if (kept && want && start == want->start && end == want->end)
+ *kept = 1;
+ saw_size = 0;
+ }
+ fclose(f);
+}
+
+static int clone_pidfd(void *stack, size_t stack_size, int *pidfd_ptr)
+{
+ struct clone_args args = {
+ .flags = CLONE_VM | CLONE_PIDFD,
+ .pidfd = (uint64_t)(uintptr_t)pidfd_ptr,
+ .exit_signal = SIGCHLD,
+ .stack = (uint64_t)(uintptr_t)stack,
+ .stack_size = stack_size,
+ };
+ register long num __asm__("a7") = __NR_clone3;
+ register long ret __asm__("a0") = (long)&args;
+ register long sz __asm__("a1") = sizeof(args);
+ int st;
+
+ asm volatile("ecall"
+ : "+r"(ret)
+ : "r"(num), "r"(sz)
+ : "memory", "cc");
+ if (ret == 0) {
+ register long n __asm__("a7") = __NR_exit;
+ register long e __asm__("a0") = 0;
+
+ asm volatile("ecall" : : "r"(n), "r"(e) : "memory");
+ __builtin_unreachable();
+ }
+ if (ret < 0)
+ return ret;
+ if (waitpid((pid_t)ret, &st, 0) < 0)
+ return -errno;
+ if (!WIFEXITED(st) || WEXITSTATUS(st) != 0)
+ return 1;
+ return 0;
+}
+
+static int depth(int n);
+static int (*depth_fn)(int) = depth;
+
+static int depth(int n)
+{
+ int (*go)(int n);
+
+ if (n <= 0)
+ return 1;
+ asm volatile("" : "=r"(go) : "0"(depth_fn) : "memory");
+ return go(n - 1) + 1;
+}
+
+static int skip_enable(long rc)
+{
+ if (rc == -EOPNOTSUPP || rc == -EINVAL) {
+ printf("[SKIP]\tkernel has no user shadow stack\n");
+ return KSFT_SKIP;
+ }
+ if (rc == -EBUSY) {
+ printf("[SKIP]\tshadow stack is locked\n");
+ return KSFT_SKIP;
+ }
+ printf("[FAIL]\tPR_SET_SHADOW_STACK_STATUS returned %ld\n", rc);
+ return 1;
+}
+
+int main(void)
+{
+ struct sigaction sa;
+ struct ss_span parent;
+ void *stack;
+ void *bad_pidfd;
+ unsigned long ssp, ssp_mid;
+ unsigned long ss_mode;
+ long rc;
+ int pidfd;
+ int vmas0, kb0, vmas1, kb1;
+ int i, kept, d, cret;
+
+ setbuf(stdout, NULL);
+
+ stack = mmap(NULL, STACK_SIZE, PROT_READ | PROT_WRITE,
+ MAP_PRIVATE | MAP_ANONYMOUS | MAP_STACK, -1, 0);
+ if (stack == MAP_FAILED) {
+ perror("mmap stack");
+ return 1;
+ }
+ bad_pidfd = mmap(NULL, 4096, PROT_NONE,
+ MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
+ if (bad_pidfd == MAP_FAILED) {
+ perror("mmap pidfd");
+ return 1;
+ }
+
+ rc = my_syscall5(__NR_prctl, PR_GET_SHADOW_STACK_STATUS,
+ (long)&ss_mode, 0, 0, 0);
+ if (rc) {
+ if (rc == -EOPNOTSUPP || rc == -EINVAL) {
+ printf("[SKIP]\tkernel has no user shadow stack\n");
+ return KSFT_SKIP;
+ }
+ printf("[FAIL]\tPR_GET_SHADOW_STACK_STATUS returned %ld\n", rc);
+ return 1;
+ }
+ if (!(ss_mode & PR_SHADOW_STACK_ENABLE)) {
+ rc = my_syscall5(__NR_prctl, PR_SET_SHADOW_STACK_STATUS,
+ PR_SHADOW_STACK_ENABLE, 0, 0, 0);
+ if (rc)
+ return skip_enable(rc);
+ }
+
+ ssp = csr_read(CSR_SSP);
+ if (!ssp) {
+ printf("[FAIL]\tenable left SSP at 0\n");
+ _exit(1);
+ }
+
+ pidfd = -1;
+ cret = clone_pidfd(stack, STACK_SIZE, &pidfd);
+ if (cret == -ENOSYS || cret == -EINVAL || cret == -EPERM) {
+ printf("[SKIP]\tclone3 with a valid pidfd failed: %s\n",
+ strerror(-cret));
+ _exit(KSFT_SKIP);
+ }
+ if (cret < 0) {
+ printf("[FAIL]\tclone3 with a valid pidfd failed: %s\n",
+ strerror(-cret));
+ _exit(1);
+ }
+ if (cret) {
+ printf("[FAIL]\tclone3 with a valid pidfd did not exit 0\n");
+ _exit(1);
+ }
+ if (pidfd < 0) {
+ printf("[FAIL]\tclone3 succeeded but did not write a pidfd\n");
+ _exit(1);
+ }
+ close(pidfd);
+
+ memset(&sa, 0, sizeof(sa));
+ sa.sa_handler = on_fault;
+ if (sigaction(SIGSEGV, &sa, NULL) || sigaction(SIGBUS, &sa, NULL)) {
+ perror("sigaction");
+ _exit(1);
+ }
+
+ ssp = csr_read(CSR_SSP);
+ ss_scan(&vmas0, &kb0, ssp, &parent, NULL, NULL);
+ if (!parent.start) {
+ printf("[FAIL]\tSSP %lx matches no shadow-stack VMA\n", ssp);
+ _exit(1);
+ }
+
+ for (i = 0; i < NCLONE; i++) {
+ cret = clone_pidfd(stack, STACK_SIZE, bad_pidfd);
+ if (cret == -EFAULT)
+ continue;
+ if (cret < 0)
+ printf("[FAIL]\tbad pidfd errno %d, want EFAULT\n",
+ -cret);
+ else
+ printf("[FAIL]\tbad pidfd was accepted\n");
+ _exit(1);
+ }
+
+ ss_scan(&vmas1, &kb1, 0, NULL, &parent, &kept);
+ ssp_mid = csr_read(CSR_SSP);
+ d = -1;
+ if (kept && ssp_mid)
+ d = depth(16);
+ ssp = csr_read(CSR_SSP);
+
+ printf("ss_vmas=%d->%d delta=%d ss_kb=%d->%d\n",
+ vmas0, vmas1, vmas1 - vmas0, kb0, kb1);
+ printf("parent=%lx-%lx kept=%d ssp_before_depth=%lx depth=%d ssp=%lx\n",
+ parent.start, parent.end, kept, ssp_mid, d, ssp);
+
+ if (vmas1 != vmas0 || kb1 != kb0) {
+ printf("[FAIL]\tleaked %d shadow-stack VMA(s), %d kB\n",
+ vmas1 - vmas0, kb1 - kb0);
+ _exit(1);
+ }
+ if (!kept) {
+ printf("[FAIL]\tparent shadow stack %lx-%lx was unmapped\n",
+ parent.start, parent.end);
+ _exit(2);
+ }
+ if (!ssp_mid) {
+ printf("[FAIL]\tparent SSP was 0 before call/return\n");
+ _exit(2);
+ }
+ if (d != 17) {
+ printf("[FAIL]\tparent call/return returned %d, want 17\n", d);
+ _exit(2);
+ }
+ if (!ssp) {
+ printf("[FAIL]\tparent SSP is 0 after call/return\n");
+ _exit(2);
+ }
+
+ printf("[OK]\tno shadow-stack VMA leak; parent stack still works\n");
+ _exit(0);
+}
--
2.43.0
^ permalink raw reply [flat|nested] 5+ messages in thread