From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from galois.linutronix.de (Galois.linutronix.de [193.142.43.55]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id EDDE93C13E3; Fri, 3 Jul 2026 09:55:51 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=193.142.43.55 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783072556; cv=none; b=TqmWRIr/HvM8uu8tfoZMSOzNAz63sf6BBujtDrmXgEwgUosmpmimemnA0iBGyp2555ehhn4hEiE30tGmL5A/2jC7hKpEJk/Bd7bMV3TTYdi0iTxVIFDhfm5XZbvxDtxAOew0riMsktFHE2B9mn1JfTMepEr2VJbwoMYyrBqCUwY= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783072556; c=relaxed/simple; bh=gsR/5oZmtrJGf9b0Ixbs2yA2T7qjUSb9v/2/4R6Bqxs=; h=Date:From:To:Subject:Cc:In-Reply-To:References:MIME-Version: Message-ID:Content-Type; b=XRyAjamBWYD5zkwjH7czBYPdmOxYv428/Xcu1jKzjVqH9zBwtL97C+Un+ob5bKQqk9GucH8D4wTnENS6C16fVkWRg3T8aiyjRrMWS1NkqlH7b9/RaciHOvLk05b0e72G9J9/8ppiiZ4LJpSuqoALwdjgUKrAF4VkKyA4r9xoPKY= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linutronix.de; spf=pass smtp.mailfrom=linutronix.de; dkim=pass (2048-bit key) header.d=linutronix.de header.i=@linutronix.de header.b=0lKxzGZW; dkim=permerror (0-bit key) header.d=linutronix.de header.i=@linutronix.de header.b=JALPNymW; arc=none smtp.client-ip=193.142.43.55 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linutronix.de Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linutronix.de Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=linutronix.de header.i=@linutronix.de header.b="0lKxzGZW"; dkim=permerror (0-bit key) header.d=linutronix.de header.i=@linutronix.de header.b="JALPNymW" Date: Fri, 03 Jul 2026 09:55:46 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linutronix.de; s=2020; t=1783072547; h=from:from:sender:sender:reply-to:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=xiiCZm20QQzJSGNV+kiN4FhjCjTegHC/is2Kl8zSskU=; b=0lKxzGZWzdfmY3bZbJuWSqbjbT7ZtTEgASkhUgYNbsKoOccExq8/Ro+gW6xI1ka4tS5EN8 vkPOORcXFZp+6Y6igNT/7TIngktb5y7+9yXavpGIrr1EyXvz6LPDq6Tb8OlZUIiMqJkPYV sSKJSo1K5lFZuq+ifI7pZhsAJVjQA7mv8lB1zzF0CbWfbACayfZJnw0HBzy5kQxq87Kk9w ZiwhoN2qtP6DFge2LvIt6g0e4h/uUufDSbBCGDrdK6J8RZO6PrNMw/tZK2nhM/v/FNEGDk BSIo+LMgyEU581HPYyIwGgibbkptC1mppch+VO9Q75RzJ9QCYLsT8NSebRwBDA== DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=linutronix.de; s=2020e; t=1783072547; h=from:from:sender:sender:reply-to:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=xiiCZm20QQzJSGNV+kiN4FhjCjTegHC/is2Kl8zSskU=; b=JALPNymWf9/pigHYt+mozaJfXFlgRyTwGRH9GjqcAh+8o4wUHMNcG/H7vfFwWfxfXblttt uxKiOohqy6nACEDw== From: "tip-bot2 for David Windsor" Sender: tip-bot2@linutronix.de Reply-to: linux-kernel@vger.kernel.org To: linux-tip-commits@vger.kernel.org Subject: [tip: perf/urgent] x86/uprobes: Keep shadow stack in sync for emulated CALLs Cc: David Windsor , "Peter Zijlstra (Intel)" , Oleg Nesterov , Jiri Olsa , x86@kernel.org, linux-kernel@vger.kernel.org In-Reply-To: <8b5b1c7407b98f31664ad7b6a6faf20d2d4a6cad.1782777969.git.dwindsor@gmail.com> References: <8b5b1c7407b98f31664ad7b6a6faf20d2d4a6cad.1782777969.git.dwindsor@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Message-ID: <178307254612.3843924.17096541454538259909.tip-bot2@tip-bot2> Robot-ID: Robot-Unsubscribe: Contact to get blacklisted from these emails Precedence: bulk Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable The following commit has been merged into the perf/urgent branch of tip: Commit-ID: abf08854d224085e2ebb3ba660e7995909f47d6a Gitweb: https://git.kernel.org/tip/abf08854d224085e2ebb3ba660e7995909f= 47d6a Author: David Windsor AuthorDate: Mon, 29 Jun 2026 20:13:33 -04:00 Committer: Peter Zijlstra CommitterDate: Thu, 02 Jul 2026 13:21:49 +02:00 x86/uprobes: Keep shadow stack in sync for emulated CALLs Uprobe CALL emulation updates the normal user stack, but not the CET user shadow stack. The subsequent RET then sees a stale shadow stack entry and raises #CP. Update the relative CALL emulation and XOL CALL fixup paths to keep the shadow stack in sync. Fixes: 488af8ea7131 ("x86/shstk: Wire in shadow stack interface") Signed-off-by: David Windsor Signed-off-by: Peter Zijlstra (Intel) Acked-by: Oleg Nesterov Acked-by: Jiri Olsa Tested-by: Jiri Olsa Link: https://patch.msgid.link/8b5b1c7407b98f31664ad7b6a6faf20d2d4a6cad.17827= 77969.git.dwindsor@gmail.com --- arch/x86/kernel/uprobes.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/arch/x86/kernel/uprobes.c b/arch/x86/kernel/uprobes.c index ebb1baf..d74bb54 100644 --- a/arch/x86/kernel/uprobes.c +++ b/arch/x86/kernel/uprobes.c @@ -1246,9 +1246,15 @@ static int default_post_xol_op(struct arch_uprobe *aup= robe, struct pt_regs *regs long correction =3D utask->vaddr - utask->xol_vaddr; regs->ip +=3D correction; } else if (auprobe->defparam.fixups & UPROBE_FIX_CALL) { + unsigned long retaddr =3D utask->vaddr + auprobe->defparam.ilen; + int err; + regs->sp +=3D sizeof_long(regs); /* Pop incorrect return address */ - if (emulate_push_stack(regs, utask->vaddr + auprobe->defparam.ilen)) + if (emulate_push_stack(regs, retaddr)) return -ERESTART; + err =3D shstk_update_last_frame(retaddr); + if (err) + return err; } /* popf; tell the caller to not touch TF */ if (auprobe->defparam.fixups & UPROBE_FIX_SETF) @@ -1338,6 +1344,10 @@ static bool branch_emulate_op(struct arch_uprobe *aupr= obe, struct pt_regs *regs) */ if (emulate_push_stack(regs, new_ip)) return false; + if (shstk_push(new_ip) =3D=3D -EFAULT) { + regs->sp +=3D sizeof_long(regs); + return false; + } } else if (!check_jmp_cond(auprobe, regs)) { offs =3D 0; }