On Mon, Oct 19, 2026 at 03:03:43PM +0200, David Hildenbrand (Arm) wrote:
> On 10/19/26 03:03, Ning, Hongyu wrote:
> > Commit 3c58f641e813 ("userfaultfd: prevent registration of special
> > VMAs") prevents userfaultfd registration on shadow stack VMAs to avoid
> > bypassing shadow stack protections through UFFDIO_COPY.
> >
> > The existing shadow stack selftest still expects UFFDIO_REGISTER to
> > succeed and uses UFFDIO_COPY to populate the shadow stack. This causes
> > the selftest to fail on Kernels containing this security fix.
> >
> > Update the selftest to verify that UFFDIO_REGISTER rejects shadow stack
> > VMAs with EINVAL. Remove the obsolete userfaultfd fault handling thread
> > and UFFDIO_COPY test path.
> >
> > Tested on: Intel shadow stack capable x86_64 platform
> >
> > Before fix:
> > [FAIL] Userfaultfd test with return code 1
> >
> > After fix:
> > [OK] Userfaultfd rejects shadow stack registration (EINVAL)
>
>
> Interesting, so we wouldn't be able to snapshot+restore an app that uses
> shadow
> stacks.
>
> @Mike: I assume that's not a concern for CRIU etc, right?
CRIU can do snapshots without uffd and it can do shadow stacks in its own
inventive way :)
> >
> > Fixes: 3c58f641e813 ("userfaultfd: prevent registration of special VMAs")
> >
> > Signed-off-by: Hongyu Ning <[email protected]>
> Acked-by: David Hildenbrand (Arm) <[email protected]>
>
> --
> Cheers,
>
> David
--
Sincerely yours,
Mike.
