[PATCH v2 0/2] x86/shstk: don't leak a shadow stack when clone TLS fails

[Iván Ezequiel Rodriguez]

copy_thread() maps a shadow stack and set_new_tls() can still fail.
That error goes to bad_fork_cleanup_io and skips exit_thread().
bad_fork_cleanup_thread calls exit_thread() only after copy_thread()
has returned 0.

commit 748c90c69336 ("x86/shstk: Remove useless clone error handling")
removed the shstk_free() on the set_new_tls() failure. Restoring it
only there puts back the single free. The allocation-error return
still aliases the parent, and the exit_thread() path is left alone,
so the double unmap that commit avoided does not come back.

The selftest uses kselftest.h / KTAP. Feature and clone3 availability
skips run before ksft_set_plan(). Missing /proc/self/smaps is SKIP.
Read errors, truncated smaps lines, and a VMA range without VmFlags
are FAIL. A valid-TLS clone3 must succeed before EPERM on a bad TLS
counts as the leak path; ENOSYS/EPERM/EACCES SKIP that control.

Regression (CONFIG_X86_USER_SHADOW_STACK=y, host and one-vCPU KVM
-cpu host,migratable=off):

  Scenario                         Without fix          With fix
  16 bad-TLS clone3                +16 ss VMAs          +0 ss VMAs
  Parent shadow stack              kept + call/ret OK   kept + call/ret OK
  KTAP                             2/3 (test 3 fail)    3/3 pass

Changes in v2:

- Nest the TLS error check under CLONE_SETTLS, as suggested by Rick
  Edgecombe.

- Use a dedicated shadow-stack cleanup label.

- Return zero explicitly on the successful path.

- Remove the redundant cleanup comment.

- Selftest: rewrite on kselftest.h / KTAP (plan 3). Fix RDSSPQ
  comment; align get_ssp() with test_shadow_stack; SKIP only
  ENOSYS/EPERM/EACCES on the valid-TLS control; FAIL on truncated or
  incomplete smaps records that would under-count ss VMAs.

Link: https://lore.kernel.org/lkml/20261015023147.519257-1-ivanrwcm25@xxxxxxxxx/

Iván Ezequiel Rodriguez (2):
  x86/shstk: free shadow stack when copy_thread() fails
  selftests/x86: shadow stack must survive a bad TLS

 arch/x86/kernel/process.c                     |  13 +-
 tools/testing/selftests/x86/Makefile          |   3 +-
 tools/testing/selftests/x86/shstk_clone_tls.c | 334 ++++++++++++++++++
 3 files changed, 346 insertions(+), 4 deletions(-)
 create mode 100644 tools/testing/selftests/x86/shstk_clone_tls.c

-- 
2.43.0