[PATCH 0/3] x86/shstk: ban ia32 sigreturn

[Richard Patel]

User shadow stacks protect only the x64 and x32 rt_sigreturn syscalls.
Calling ia32 rt_sigreturn, which lacks return address validation, is
still possible via `int $0x80`. The bypass also requires the executable
is mapped into low 32-bit address space. (This scenario is basically
impossible to occur in the wild, but it's probably worth fixing
nonetheless.)

Since user shadow stacks explicitly only support 64-bit mode, the
simplest fix is to fault attempts to do 32-bit rt_sigreturn.

Richard Patel (3):
  x86/shstk: ban ia32 sigreturn when shadow stack is enabled
  selftests/x86: test shadow stack sigreturn protection
  selftests/x86: skip shstk tests where perf_event_open() fails

 arch/x86/kernel/signal_32.c                   |   4 +
 .../testing/selftests/x86/test_shadow_stack.c | 120 +++++++++++++++++-
 2 files changed, 122 insertions(+), 2 deletions(-)

--
2.52.0