[hexadecimated]

The post-fork canary value could be paired with the stack pointer at which it became valid. If not valid, the process could walk a linked list of pre-fork canary and stack pointer pairs, to find the correct value to use. Would be interesting to see the performance hit on such an approach.

[tedunangst]

Or not. The stack canary is not the only random value reset upon exec.