Re: [PATCH 5/6] x86/shstk: don't create the shadow stack for PF_USER_WORKERs

From: Edgecombe, Rick P
Date: Thu Aug 14 2025 - 18:49:44 EST


On Thu, 2025-08-14 at 19:33 +0100, Mark Brown wrote:
> > How about just adding the 'minimal' condition to:
> >   if (clone_flags & CLONE_VFORK) {
> >   shstk->base = 0;
> >   shstk->size = 0;
> >   return 0;
> >   }
> > ...then update all the comments where vfork is called out as the only case
> > that
> > does this?
>
> Perhaps we should factor the logic for deciding if we need to allocate a
> userspace shadow stack out into the arch independent code and do
> something like set a flag in kernel_clone_args that the arches can
> check?  I think the logic is the same for all arches at the minute and
> don't see a reason why it'd diverge.

Sounds good. Like a little start to this:
https://lore.kernel.org/lkml/20241010-shstk_converge-v1-0-631beca676e7@xxxxxxxxxxxx/

>   That'd collide a bit with my
> clone3() series, there's some overlap there with that creating another
> reason why the decision would change.  Reducing the duplication would be
> nice.

Argh, I need to test the latest of that still.