Messages in this thread | | | From | Florian Weimer <> | Subject | Re: [PATCH v2 18/39] mm: Add guard pages around a shadow stack. | Date | Mon, 10 Oct 2022 14:33:30 +0200 |
| |
* Andrew Cooper:
> You don't actually need a hole to create a guard. Any mapping of type > != shstk will do. > > If you've got a load of threads, you can tightly pack stack / shstk / > stack / shstk with no holes, and they each act as each other guard pages.
Can userspace read the shadow stack directly? Writing is obviously blocked, but reading?
GCC's stack-clash probing uses OR instructions, so it would be fine with a readable mapping. POSIX does not appear to require PROT_NONE mappings for the stack guard region, either. However, the pthread_attr_setguardsize manual page pretty clearly says that it's got to be unreadable and unwriteable. Hence my question.
Thanks, Florian
| |