Re: Random shadow stack pointer corruption

From: Andy Lutomirski
Date: Sat Jul 18 2020 - 14:00:43 EST


On Sat, Jul 18, 2020 at 10:58 AM Yu-cheng Yu <yu-cheng.yu@xxxxxxxxx> wrote:
>
> Hi,
>
> My shadow stack tests start to have random shadow stack pointer corruption after
> v5.7 (excluding). The symptom looks like some locking issue or the kernel is
> confused about which CPU a task is on. In later tip/master, this can be
> triggered by creating two tasks and each does continuous
> pthread_create()/pthread_join(). If the kernel has max_cpus=1, the issue goes
> away. I also checked XSAVES/XRSTORS, but this does not seem to be an issue
> coming from there.

What do you mean "shadow stack pointer corruption"? Is SSP itself
corrupt while running in the kernel? Is one of the MSRs getting
corrupted? Is the memory to which the shadow stack points getting
corrupted? Is the CPU rejecting an attempt to change SSP?

--Andy

>
> The tests I run take a long time to complete, and some commit points in bisect
> do not show failures right away. However, the issue can be more easily
> triggered after the point of:
>
> d77290507ab2 x86/entry/32: Convert IRET exception to IDTENTRY_SW
>
> Can anyone help me find places to look at?
>
> Thanks,
> Yu-cheng
>