From nobody Sun Feb 8 12:43:12 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 03EDCC001B0 for ; Wed, 19 Jul 2023 22:48:10 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231145AbjGSWsH (ORCPT ); Wed, 19 Jul 2023 18:48:07 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:42348 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229707AbjGSWre (ORCPT ); Wed, 19 Jul 2023 18:47:34 -0400 Received: from galois.linutronix.de (Galois.linutronix.de [IPv6:2a0a:51c0:0:12e:550::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 2094A1FF9; Wed, 19 Jul 2023 15:47:33 -0700 (PDT) Date: Wed, 19 Jul 2023 22:47:30 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linutronix.de; s=2020; t=1689806850; h=from:from:sender:sender:reply-to:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=8BTHQ7pBpYtAgK36iWl38TXsRPCr6YngSby2bITbJ3I=; b=c2jAOpoOAsaJBZocjZCu8i+xIDIFLxL+PhPGvoQs9Tg4e/EoJhp0yeFDIEMX4d7v/22PMq 3verXIHv+M88m02Xm7lXQR4QmRcMX15b30N+kewXBO7GT6vsUfek9V9rGiB7svpNeiymGz hSpPL9GBjbvORZMElcX3ffAcxz3y5qrbZWa5dwtKeYa1WmCIsEI2rEXhlyfg/kvInTBb9e HRhts7j6TrG4JvJTPH7IJuvJCA5oWosyDrtgQ8Nbr2gGPRkBGwGvdRP7mJn6VFmZS4LlAV mMqTDWQbDF5g8tGx63rn6hpqeirAfc7BCZjOY2iD3PktGOmBRd7Wq3A5eQBm7g== DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=linutronix.de; s=2020e; t=1689806850; h=from:from:sender:sender:reply-to:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=8BTHQ7pBpYtAgK36iWl38TXsRPCr6YngSby2bITbJ3I=; b=YRfJolYymDr5/6Bj9fZOWxC0VktrZN2c3ubjeKjmFtE5Z0WsZ+HzKQqr+ueNd2D2N+y7Ow +wpfhoqr6/m0YYBw== From: "tip-bot2 for Rick Edgecombe" Sender: tip-bot2@linutronix.de Reply-to: linux-kernel@vger.kernel.org To: linux-tip-commits@vger.kernel.org Subject: [tip: x86/shstk] x86/shstk: Check that SSP is aligned on sigreturn Cc: Rick Edgecombe , Dave Hansen , x86@kernel.org, linux-kernel@vger.kernel.org MIME-Version: 1.0 Message-ID: <168980685014.28540.14547624168811413141.tip-bot2@tip-bot2> Robot-ID: Robot-Unsubscribe: Contact to get blacklisted from these emails Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org The following commit has been merged into the x86/shstk branch of tip: Commit-ID: 580c301b703f720a18bf0a03cedf57f961d80eea Gitweb: https://git.kernel.org/tip/580c301b703f720a18bf0a03cedf57f96= 1d80eea Author: Rick Edgecombe AuthorDate: Mon, 12 Jun 2023 17:10:58 -07:00 Committer: Rick Edgecombe CommitterDate: Tue, 11 Jul 2023 14:12:50 -07:00 x86/shstk: Check that SSP is aligned on sigreturn The shadow stack signal frame is read by the kernel on sigreturn. It relies on shadow stack memory protections to prevent forgeries of this signal frame (which included the pre-signal SSP). It also relies on the shadow stack signal frame to have bit 63 set. Since this bit would not be set via typical shadow stack operations, so the kernel can assume it was a value it placed there. However, in order to support 32 bit shadow stack, the INCSSPD instruction can increment the shadow stack by 4 bytes. In this case SSP might be pointing to a region spanning two 8 byte shadow stack frames. It could confuse the checks described above. Since the kernel only supports shadow stack in 64 bit, just check that the SSP is 8 byte aligned in the sigreturn path. Signed-off-by: Rick Edgecombe Signed-off-by: Dave Hansen Link: https://lore.kernel.org/all/20230613001108.3040476-33-rick.p.edgecomb= e%40intel.com --- arch/x86/kernel/shstk.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/arch/x86/kernel/shstk.c b/arch/x86/kernel/shstk.c index f02e8ea..a8705f7 100644 --- a/arch/x86/kernel/shstk.c +++ b/arch/x86/kernel/shstk.c @@ -252,6 +252,9 @@ static int shstk_pop_sigframe(unsigned long *ssp) unsigned long token_addr; int err; =20 + if (!IS_ALIGNED(*ssp, 8)) + return -EINVAL; + err =3D get_shstk_data(&token_addr, (unsigned long __user *)*ssp); if (unlikely(err)) return err;