Messages in this thread | | | From | Andrew Cooper <> | Subject | Re: [PATCH v2 18/39] mm: Add guard pages around a shadow stack. | Date | Mon, 10 Oct 2022 13:32:51 +0000 |
| |
On 10/10/2022 13:33, Florian Weimer wrote: > * Andrew Cooper: > >> You don't actually need a hole to create a guard. Any mapping of type >> != shstk will do. >> >> If you've got a load of threads, you can tightly pack stack / shstk / >> stack / shstk with no holes, and they each act as each other guard pages. > Can userspace read the shadow stack directly? Writing is obviously > blocked, but reading?
Yes - regular reads are permitted to shstk memory.
It's actually a great way to get backtraces with no extra metadata needed.
> GCC's stack-clash probing uses OR instructions, so it would be fine with > a readable mapping.
It's `or $0, (%rsp)` which is a read/modify/write and will fault when hitting a shstk mapping.
> POSIX does not appear to require PROT_NONE mappings > for the stack guard region, either. However, the > pthread_attr_setguardsize manual page pretty clearly says that it's got > to be unreadable and unwriteable. Hence my question.
Hmm. If that's what the manuals say, then fine.
But honestly, you don't get very far at all without faulting on a read-only stack.
~Andrew
| |