Commit 3c58f641e813 ("userfaultfd: prevent registration of special
VMAs") prevents userfaultfd registration on shadow stack VMAs to avoid
bypassing shadow stack protections through UFFDIO_COPY.
The existing shadow stack selftest still expects UFFDIO_REGISTER to
succeed and uses UFFDIO_COPY to populate the shadow stack. This causes
the selftest to fail on Kernels containing this security fix.
Update the selftest to verify that UFFDIO_REGISTER rejects shadow stack
VMAs with EINVAL. Remove the obsolete userfaultfd fault handling thread
and UFFDIO_COPY test path.
Tested on: Intel shadow stack capable x86_64 platform
Before fix:
[FAIL] Userfaultfd test with return code 1
After fix:
[OK] Userfaultfd rejects shadow stack registration (EINVAL)
Fixes: 3c58f641e813 ("userfaultfd: prevent registration of special VMAs")
Signed-off-by: Hongyu Ning <[email protected]>
ChatGPT was used to assist with root-cause analysis and patch
preparation. The changes were reviewed and validated on Intel shadow
stack capable x86_64 platform, with all 12 shadow stack tests passing.
---
.../testing/selftests/x86/test_shadow_stack.c | 105 ++++++------------
1 file changed, 34 insertions(+), 71 deletions(-)
diff --git a/tools/testing/selftests/x86/test_shadow_stack.c
b/tools/testing/selftests/x86/test_shadow_stack.c
index 3d6ca33edba4..d8d3122cbb43 100644
--- a/tools/testing/selftests/x86/test_shadow_stack.c
+++ b/tools/testing/selftests/x86/test_shadow_stack.c
@@ -27,7 +27,6 @@
#include <sys/prctl.h>
#include <stdint.h>
#include <signal.h>
-#include <pthread.h>
#include <sys/ioctl.h>
#include <linux/userfaultfd.h>
#include <setjmp.h>
@@ -450,48 +449,16 @@ int test_mprotect(void)
return 0;
}
-char zero[4096];
-
-static void *uffd_thread(void *arg)
-{
- struct uffdio_copy req;
- int uffd = *(int *)arg;
- struct uffd_msg msg;
- int ret;
-
- while (1) {
- ret = read(uffd, &msg, sizeof(msg));
- if (ret > 0)
- break;
- else if (errno == EAGAIN)
- continue;
- return (void *)1;
- }
-
- req.dst = msg.arg.pagefault.address;
- req.src = (__u64)zero;
- req.len = 4096;
- req.mode = 0;
-
- if (ioctl(uffd, UFFDIO_COPY, &req))
- return (void *)1;
-
- return (void *)0;
-}
-
+/*
+ * Shadow stack VMAs must not be registered with userfaultfd. In particular,
+ * UFFDIO_COPY must not be able to populate a shadow stack with arbitrary data.
+ */
int test_userfaultfd(void)
{
- struct uffdio_register uffdio_register;
- struct uffdio_api uffdio_api;
- struct sigaction sa = {};
- pthread_t thread;
- void *res;
- int uffd;
-
- sa.sa_sigaction = test_access_fix_handler;
- sa.sa_flags = SA_SIGINFO;
- if (sigaction(SIGSEGV, &sa, NULL))
- return 1;
+ struct uffdio_register uffdio_register = {};
+ struct uffdio_api uffdio_api = {};
+ void *shstk;
+ int uffd, ret = 1;
uffd = syscall(__NR_userfaultfd, O_CLOEXEC | O_NONBLOCK);
if (uffd < 0) {
@@ -499,43 +466,39 @@ int test_userfaultfd(void)
return 0;
}
- reset_test_shstk(0);
+ shstk = create_shstk(0);
+ if (shstk == MAP_FAILED) {
+ printf("[FAIL]\tCould not create shadow stack\n");
+ close(uffd);
+ return 1;
+ }
uffdio_api.api = UFFD_API;
- uffdio_api.features = 0;
- if (ioctl(uffd, UFFDIO_API, &uffdio_api))
- goto err;
+ if (ioctl(uffd, UFFDIO_API, &uffdio_api)) {
+ printf("[FAIL]\tUFFDIO_API failed: %s\n", strerror(errno));
+ goto out;
+ }
- uffdio_register.range.start = (__u64)shstk_ptr;
- uffdio_register.range.len = 4096;
+ uffdio_register.range.start = (__u64)shstk;
+ uffdio_register.range.len = PAGE_SIZE;
uffdio_register.mode = UFFDIO_REGISTER_MODE_MISSING;
- if (ioctl(uffd, UFFDIO_REGISTER, &uffdio_register))
- goto err;
-
- if (pthread_create(&thread, NULL, &uffd_thread, &uffd))
- goto err;
-
- reset_shstk(shstk_ptr);
- test_shstk_access(shstk_ptr);
-
- if (pthread_join(thread, &res))
- goto err;
-
- if (test_shstk_access(shstk_ptr))
- goto err;
-
- free_shstk(shstk_ptr);
+ if (!ioctl(uffd, UFFDIO_REGISTER, &uffdio_register)) {
+ printf("[FAIL]\tUserfaultfd registered a shadow stack VMA\n");
+ goto out;
+ }
- signal(SIGSEGV, SIG_DFL);
+ if (errno != EINVAL) {
+ printf("[FAIL]\tUFFDIO_REGISTER: expected EINVAL, got %s\n",
+ strerror(errno));
+ goto out;
+ }
- if (!res)
- printf("[OK]\tUserfaultfd test\n");
- return !!res;
-err:
- free_shstk(shstk_ptr);
+ printf("[OK]\tUserfaultfd rejects shadow stack registration
(EINVAL)\n");
+ ret = 0;
+out:
+ free_shstk(shstk);
close(uffd);
- signal(SIGSEGV, SIG_DFL);
- return 1;
+ return ret;
}
/* Simple linked list for keeping track of mappings in test_guard_gap() */
--
2.43.0
