Re: [PATCH] x86/CET: Update vfork to prevent child return

[Florian Weimer <fw@deneb.enyo.de>]

* H. J. Lu via Libc-alpha:

> Child of vfork should either call _exit or one of the exec family of
> functions.  But normally there is nothing to prevent child of vfork from
> returning to caller of vfork's caller.  With shadow stack enabled, we
> can introduce mismatched shadow stack in child of vfork.  When the child
> returns from the function in which vfork was called, mismatched shadow
> stack will trigger SIGSEGV.
> ---
>  sysdeps/unix/sysv/linux/i386/vfork.S          |  6 +++
>  sysdeps/unix/sysv/linux/x86/Makefile          |  5 ++
>  sysdeps/unix/sysv/linux/x86/tst-cet-vfork-1.c | 54 +++++++++++++++++++
>  sysdeps/unix/sysv/linux/x86_64/vfork.S        |  6 +++
>  4 files changed, 71 insertions(+)
>  create mode 100644 sysdeps/unix/sysv/linux/x86/tst-cet-vfork-1.c
>
> diff --git a/sysdeps/unix/sysv/linux/i386/vfork.S b/sysdeps/unix/sysv/linux/i386/vfork.S
> index ceb41db0bd..e54fdb7e4c 100644
> --- a/sysdeps/unix/sysv/linux/i386/vfork.S
> +++ b/sysdeps/unix/sysv/linux/i386/vfork.S
> @@ -91,6 +91,12 @@ ENTRY (__vfork)
>  	/* Normal return if shadow stack isn't in use.  */
>  	je	L(no_shstk)
>  
> +	testl	%eax, %eax
> +	jnz	2f
> +	/* NB: Jump back to caller directly with mismatched shadow stack
> +	   to prevent child return.  */
> +	jmp	*%ecx
> +2:

Doesn't the jmp need a notrack prefix?  Or does GCC generate special
code for returns_twice functions?

The comment should say that the *function* calling vfork cannot return
in the subprocess.

> diff --git a/sysdeps/unix/sysv/linux/x86/Makefile b/sysdeps/unix/sysv/linux/x86/Makefile
> index 920edd8948..f3fae85c1e 100644
> --- a/sysdeps/unix/sysv/linux/x86/Makefile
> +++ b/sysdeps/unix/sysv/linux/x86/Makefile
> @@ -47,6 +47,11 @@ $(objpfx)tst-cet-property-2.out: $(objpfx)tst-cet-property-2 \
>  	  $(evaluate-test)
>  endif
>  
> +ifeq ($(subdir),posix)
> +tests += tst-cet-vfork-1
> +CFLAGS-tst-cet-vfork-1.c += -mshstk
> +endif

Does -mshstk alter the ISA?  Then I think you can't test for the
presence of support if you build the whole translation unit with
-mshstk.

> diff --git a/sysdeps/unix/sysv/linux/x86/tst-cet-vfork-1.c b/sysdeps/unix/sysv/linux/x86/tst-cet-vfork-1.c
> new file mode 100644
> index 0000000000..9ca148e857
> --- /dev/null
> +++ b/sysdeps/unix/sysv/linux/x86/tst-cet-vfork-1.c
> @@ -0,0 +1,54 @@
> +/* Verify that child of vfork can't return with shadow stack.

Likewise: It's the vfork-calling function that must not return.

> +__attribute__ ((noclone, noinline))
> +static pid_t
> +do_test_1 (void)
> +{
> +  pid_t pid;
> +
> +  pid = vfork ();
> +  if (pid == 0)
> +    {
> +      /* Child return should trigger SIGSEGV.  */
> +      return 0;
> +    }
> +  _exit (EXIT_SUCCESS);
> +
> +  return pid;

The return statement immediately above is unreachable.

> +static int
> +do_test (void)
> +{
> +  /* NB: This test should trigger SIGSEGV with shadow stack enabled.  */
> +  if (_get_ssp () == 0)
> +    return EXIT_UNSUPPORTED;
> +  return do_test_1 () ? EXIT_SUCCESS : EXIT_FAILURE;
> +}
> +
> +#define EXPECTED_SIGNAL (_get_ssp () == 0 ? 0 : SIGSEGV)
> +#include <support/test-driver.c>

I'm surprised EXPECTED_SIGNAL works here.  I would expect that the
original test process would have to wait using xwaitpid and check for
the signal in the subprocess.

I think it would also be good to add a check that the subprocess
actually returned from vfork without crashing, say using a pipe and a
write before the return statement.

> diff --git a/sysdeps/unix/sysv/linux/x86_64/vfork.S b/sysdeps/unix/sysv/linux/x86_64/vfork.S
> index 776d2fc610..5dd5cb714c 100644
> --- a/sysdeps/unix/sysv/linux/x86_64/vfork.S
> +++ b/sysdeps/unix/sysv/linux/x86_64/vfork.S
> @@ -71,6 +71,12 @@ ENTRY (__vfork)
>  	/* Normal return if shadow stack isn't in use.  */
>  	je	L(no_shstk)
>  
> +	testl	%eax, %eax
> +	jnz	2f
> +	/* NB: Jump back to caller directly with mismatched shadow stack
> +	   to prevent child return.  */
> +	jmp	*%rdi
> +2:
>  	/* Pop return address from shadow stack and jump back to caller
>  	   directly.  */
>  	movl	$1, %esi

See above.