From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=209.85.221.182 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1792707454; b=e/tvuLdAiQQp6B3bGBjcL5ZKRSUDJXCQdZB4Hkblfq0mebxdA8+L/4bY/nSn5eHUbNqA aiJlVYZgD8vgOJHbf+L6ruZnJSiYixKMoBepwJSaLqBMwyXzXjvdw46PHhX7yuGwZpyOu +wJTEcxYuVUbJBJOE9MFQH18Ex6W6L/bAFmsaX1DffBIB9V64/3wLoCSN5e4JH/ZojnN5 BAFBBqcOSZ3gk5G+Velbg0Yyyi9G89DbPsPJzfWj8bW1YUvJeTM/GOubo5ZquI5EiFXYF L5PT6e9EKoES/FbjsN77TElePHsA45i8dynwalatXeDMcqYLHRPY+q6XcIhEI32N1gQ== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1792707454; h=DMARC-Filter:Received:DKIM-Signature:X-Google-DKIM-Signature: X-Forwarded-Encrypted:X-Gm-Message-State:X-Gm-Gg:X-Received:Received: From:To:Cc:Subject:Date:Message-ID:X-Mailer:In-Reply-To:References: MIME-Version:Content-Type:Content-Transfer-Encoding; bh=/WIkpltfnb+vy/iRWdcQeenTOR+kthNZwD1BDIJsCtY=; b=zK+BywdDHOsEgVy08QkVG/zjkaFkffKJ41d48s55jn0LEJBxPHvD1FatCv7jdhyxYUjd Mjf+xJbsTUtYjcOKP9ZNbWeD4uCTQx+RTAF2Pxs72Loilh6iHWn53g+lnfMKOCRcV/rEO DepvXv2piCaFHCWR7ZUxHe3CTyqEacXcTYKbfk2x/ZEC2EzQQBlaneailXQAdz0puB33i pQ/Io9Km2fpaN1aIC95bUEr6TMyweIOOeY5dz/WemCSQt280xa6TyOiJTCOCnugwLfylg Pr2u/+/Awac6pdoNdTRg7esTlQzQi4aaHfb2ZtkpCAkTjxNPHMG3FWGLVweBektIg1Q== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass header.d=gmail.com header.i=@gmail.com header.a=rsa-sha256 header.s=20251104 header.b=JFpZ94Ob; arc=none smtp.remote-ip=209.85.221.182 Received: from mail-vk1-f182.google.com (mail-vk1-f182.google.com [209.85.221.182]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature ECDSA (prime256v1) server-digest SHA256) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E8839606A31D for ; Thu, 22 Oct 2026 22:17:33 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.4.2 smtp.subspace.kernel.org E8839606A31D Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key, unprotected) header.d=gmail.com header.i=@gmail.com header.a=rsa-sha256 header.s=20251104 header.b=JFpZ94Ob Received: by mail-vk1-f182.google.com with SMTP id 71dfb90a1353d-5eafa528803so130975e0c.1 for ; Thu, 22 Oct 2026 15:17:33 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1792707453; x=1793312253; darn=vger.kernel.org; h=content-transfer-encoding:content-type:mime-version:references :in-reply-to:message-id:date:subject:cc:to:from:from:to:cc:subject :date:message-id:reply-to:content-type; bh=/WIkpltfnb+vy/iRWdcQeenTOR+kthNZwD1BDIJsCtY=; b=JFpZ94Ob3Fm6+qT3OvTYTxeHkpIEU9c+VZ8lDQaWmzPXF/uzU7JrLsmPMCYrUuiLQZ 1Wtx830OvhlAppc3G4T8svioQktLUvKgcZ1KZ3v03L38/G98omE3XjY0OAmiH6DmV3ar iNs2BkVv9aPFu0Ck7fqp1MbCrDMvzbcrKtbLnpRYO9esYY5a0rpVfaZeST8FDrRLZ0rw JL3+G/uUiDflNKH7CHP3Nlk/zXwq97RxcLtFlvcXrIBOpsXfAHtyPvsF09Lqb76JVHHq jYyQMy7aMRjpbqqg/cZb2pE3wbP8ckVY5j9uytlgLoOjBec8ATLlTrk36iNJhhBXKKlS n3Ew== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792707453; x=1793312253; h=content-transfer-encoding:content-type:mime-version:references :in-reply-to:message-id:date:subject:cc:to:from:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=/WIkpltfnb+vy/iRWdcQeenTOR+kthNZwD1BDIJsCtY=; b=jJcXBSbk9xX7ZuFtMl1RafgWxhfp/GOPXn9AcyfqqVeezkmbGaag4VGZdCGHfh5gpR 5zoSfl9mVDZqnTb1XwrwhzlxRxVFICTA3JobSLLFt+L/iy2n450R579RyYzsDvdNRQo4 xoiUnc7feF+HxJ2MbP2xKfr8HlCc9AsT14yrQ8ZivZ6ezj2do7FXw/FwHsLYcjZSa7T2 0TOFyS0uRw/NTp+ivI+qNYStmGZKTbnT2n83TLQJN8M593W6sN3Gn60lTgDkNP59ucSN yEJrhGxXwqeYClteGu6uHMDzCQaT6A6UWTdxev1L6a3KTuX+XU3nJXlw+uVY35uIUjw4 2n8g== X-Forwarded-Encrypted: i=1; AKwUvBz4KFPGb8TgHz/eDzpJLhgXm4YWFYDtNjY10uMA+ottHz2DeIIRKI7jDnzkFwL6jDICdhGs83kfZqjBW2sAWAM=@vger.kernel.org X-Gm-Message-State: AFq9FYKBUKDQTrbvYF6Q4MmsqMR8jRvQ8PguEzc50CSFhMQyjDUiUFe+ zUezu9OFKCgLJ1XFZfS6oXwa0gJHCd4EdYMyV57l1CrAIgl37igsRGZm X-Gm-Gg: AYBFou2yauFTXtuy6ghLFG7jhwmUcVjj4Jort+eEevTLCTa8cBENWec8pb3n77HL4tV LQuFf8Sjuk4h4UkWpQe2bYitrSZ0FWV65SwvhFwwORRGLRDQbi5PolSGWRIuiZ/qJPjUzy9k6hs YCNjupXkyGTW+jk8l7l4nJFfB1mVQy5My+1nstOAZwLzQ4T0KaT9LfPRerBUSJNQwbbZ42UR8sA kt+CZMgZHc8tnL03bdzp+JI1+uJ1dVqnHw7NYOvJ04PP4mXB3rKHTuWSLqqP1i4JGnRnOa5Vf0l blF5Ot/kW9aEVgT3/mWtV99GuK07E956bqI//VSmLf9QTGttxrZIiQ5E7oiKi/NqRhYZz7Gw808 fkhegw8B42+VhdR49ugCHw4vJXeFusVcsYQ/afuPwwb+qhtsxOyROKmtOBlfuTmTfL5jbhJwc9G 7V2KxEV34EqadIs0VU4KfU4UZkEKcfl7Vg0LeK3xuFDR6nMFbxbgA4ZXS91mAKgjeKEsnzuL50c WMVufPW/TBe0meqlk0tu03YmbQOc2RmvYxFF+O54yLQVgsF4A== X-Received: by 2002:a05:6122:178c:b0:5ea:ae99:9b2c with SMTP id 71dfb90a1353d-5ec14ab087cmr87153e0c.14.1792707452787; Thu, 22 Oct 2026 15:17:32 -0700 (PDT) Received: from unix.. ([181.229.23.179]) by smtp.gmail.com with ESMTPSA id 71dfb90a1353d-5ec13f2cfe0sm456271e0c.14.2026.10.22.15.17.28 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 22 Oct 2026 15:17:32 -0700 (PDT) From: =?UTF-8?q?Iv=C3=A1n=20Ezequiel=20Rodriguez?= To: Thomas Gleixner , Ingo Molnar , Borislav Petkov , Dave Hansen , x86@kernel.org Cc: "H . Peter Anvin" , Shuah Khan , Christian Brauner , Rick Edgecombe , linux-kernel@vger.kernel.org, linux-kselftest@vger.kernel.org, =?UTF-8?q?Iv=C3=A1n=20Ezequiel=20Rodriguez?= , stable@vger.kernel.org Subject: [PATCH v2 1/2] x86/shstk: free shadow stack when copy_thread() fails Date: Thu, 22 Oct 2026 19:17:20 -0300 Message-ID: <20261022221722.619233-2-ivanrwcm25@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20261022221722.619233-1-ivanrwcm25@gmail.com> References: <20261015023147.519257-1-ivanrwcm25@gmail.com> <20261022221722.619233-1-ivanrwcm25@gmail.com> X-Mailing-List: linux-kselftest@vger.kernel.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit copy_thread() maps a shadow stack for a CLONE_VM child and can still fail in set_new_tls(). That error returns through bad_fork_cleanup_io, which does not call exit_thread(). bad_fork_cleanup_thread does, but only after copy_thread() has returned 0. commit 748c90c69336 ("x86/shstk: Remove useless clone error handling") removed the shstk_free() on this path, assuming exit_thread() would run. It does not. Each rejected clone leaves one shadow-stack VMA in the parent's mm until the mm dies: one map_count slot, pages not populated. The size follows the clone stack, or RLIMIT_STACK when that size is zero. Free only after set_new_tls() fails, via a dedicated cleanup label. Nest the TLS error check under CLONE_SETTLS so the successful path returns 0 explicitly. The allocation error returns earlier, while the child's base still aliases the parent. shstk_free() ignores a cleared base and a different mm, so CLONE_VFORK and !CLONE_VM stay no-ops. The exit_thread() path is left alone, so the double unmap that commit avoided does not come back. The io bitmap is still shared only when TLS setup succeeds. Tested with user shadow stack enabled, on one config with and without this change. Sixteen clone3() calls with CLONE_VM|CLONE_SETTLS and an out-of-range TLS leaked 16 shadow-stack VMAs without the fix. With it, the VMA count was unchanged and call/return on the parent still used the original shadow stack. Fixes: 748c90c69336 ("x86/shstk: Remove useless clone error handling") Cc: stable@vger.kernel.org Assisted-by: LLM Signed-off-by: Iván Ezequiel Rodriguez --- arch/x86/kernel/process.c | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) diff --git a/arch/x86/kernel/process.c b/arch/x86/kernel/process.c index 346c438ac880..451594fa5481 100644 --- a/arch/x86/kernel/process.c +++ b/arch/x86/kernel/process.c @@ -176,7 +176,7 @@ int copy_thread(struct task_struct *p, const struct kernel_clone_args *args) struct fork_frame *fork_frame; struct pt_regs *childregs; unsigned long new_ssp; - int ret = 0; + int ret; childregs = task_pt_regs(p); fork_frame = container_of(childregs, struct fork_frame, regs); @@ -263,12 +263,19 @@ int copy_thread(struct task_struct *p, const struct kernel_clone_args *args) } /* Set a new TLS for the child thread? */ - if (clone_flags & CLONE_SETTLS) + if (clone_flags & CLONE_SETTLS) { ret = set_new_tls(p, tls); + if (ret) + goto shstk_free; + } - if (!ret && unlikely(test_tsk_thread_flag(current, TIF_IO_BITMAP))) + if (unlikely(test_tsk_thread_flag(current, TIF_IO_BITMAP))) io_bitmap_share(p); + return 0; + +shstk_free: + shstk_free(p); return ret; } -- 2.43.0