From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-qt1-f176.google.com (mail-qt1-f176.google.com [209.85.160.176]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 0CA9BEEBA for ; Tue, 30 Jun 2026 00:13:37 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.160.176 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782778419; cv=none; b=ivDICLHxkYFEzrUNwue+Yq4A6p1xjdLw48JR9mbDsZb3nNPIgfk2SjbeIgXV/+XVyBjxIc+2XigtWs1TJng0jtPk9wsO+XKj1DaxBodC6RVkR+IRfAQCLJPx/KOTMphg+50+sCnB1a59KoKRJAOfJMdOlFfytxz0AJrKd5481/o= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782778419; c=relaxed/simple; bh=xA/Vs9V7SjmvMjzEG3jYo4JXm0pLhylCX8gmEuckYbc=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=jXBH4crHxllVLok32GLFV0oK013V4mwlqzZHIYdR4Idd36/WGVZQG1+5XBobJ22IV0m/BeLlr3JlJiBHQXrfXDXG+B2WgH3KfsAf0h/vM2FCo7DnRTqTvevvBhjyHphru8la6RO96GtDq7Cu/mdTVQJ00x/OKx1qXk9q0vJ3y/I= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=ExUoY7ee; arc=none smtp.client-ip=209.85.160.176 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="ExUoY7ee" Received: by mail-qt1-f176.google.com with SMTP id d75a77b69052e-51af8fda4c0so12681951cf.1 for ; Mon, 29 Jun 2026 17:13:37 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1782778417; x=1783383217; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=jIkraZxinUJrwI8LhBH8/tkcf/KJe4Ahg7TpFa29WD4=; b=ExUoY7eeULcP47M1bs6z/Galpsx9KC2Lj0Zn1QteJiSOmVaLNrAm6GBr3n7XGJZWdh ZiSCJVsEq3hXviQ1iYv7ABy17INGs6u7Ocs9J6bEimYyiypdE25MNxzLEs7U0kxFXyow lj/ev5mE1fBg+xlb5NnImOS+o797Uk5anjw5DQiTKXjZeIyy8TuKwjXrseZuIMrqiogQ u0C0T9NsINX8TCBDiqgHw9vzDhNNu2C2Bcd5NPw4fvaVIJxG/lvdr/AFAYNxsOmUXBRi pCpRUq+7XAUkrvm4s3LZFO14AxfPDh4dyq7XIA8kSIUhDq7isdEmzEtR7+jF1XLTPScE 28aw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1782778417; x=1783383217; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=jIkraZxinUJrwI8LhBH8/tkcf/KJe4Ahg7TpFa29WD4=; b=lw+GSr4MjvhYX1UfDmU/+au9fDEmbq1Cz9tPqbdvDtShPVTHAPVCVfZFYk2FEGTc/l Yujlfzo6WHVVJlQlkQejiAJPG1hchM860I7cuskKyIfoHtLVEQ4shPap6G8vpsdEj4FN nML2lFL7ta/OhLP80MIVFsYn4nKjf5mZB+2mEY3+UIaBJ/tb7Fpzbl/zpsEiuxJxq4g4 Z7004I9SAPcGaVpkBbosZFzde+JfT+nLwF42X1pMNF7kAsKdfg9PmqUkJOUtLoK8Ta6v SyL+ICWXQoKzKQtoQMXCXaPEiGaBuN/dUA5dbLg3B/ZEioO1OcMxL6fptZ/rCwGxCr+1 2grQ== X-Forwarded-Encrypted: i=1; AFNElJ/x1Rnp4i7D7+bhMAzLyyqlVy4FbSPmKCCm2QHd7HKKHjyniJfaGKXp94cgYzA85qCnYac+/cfnCvwQJOY=@vger.kernel.org X-Gm-Message-State: AOJu0YzBpxQzq0FrunOa9PZkzC2VvDR5dkQ0GS7itX6OFgqen+YSMZvz oafAol6qW4s9MXvqaFLDFYn+TJHFLGX255OeKoewcZo8PufVI79czLqp X-Gm-Gg: AfdE7cleXsl95zr4ZGNtN+bgSCUMhnoekYlKb4hZkpgyro1Ya/SpdbdRxlKy+xs3dpr tJdr1sxRYxWtK3R1cl92e7KbhPEpd6Nh7T7/gXAuL1881V1XLO+Q5J9+Ssf5VjG03qaP1/FzGya ZfelAgMbrjrSoRqAaDAw2Sx246PHCFT8Iea/qaDMijvL+oWltNThycEjgDk7W6B+47OwOirq9om 4La7yzS+jcr78SlJLx43THPm+ZhZuDtEf5jIY4C4OiUvBvZIT9Mk2Byzgdi2+Qec3q9hYL/2Avz e2OHScxlyxIsZz0cLWArViIRCB/G81i03+4AsnJ/kX7pAtk4OX6eGpfbvaRBi8ow8z+qxOUJFcU ml4Fa1Fr9BDwRUjVGP/JzywNKrYm1XbKkD5vUzyqxAlnCHF582FBNjRIIKryeGtSdz2ikAJb/2a LcdMJizAbKcoz3FtkYwN8k80/4HkFWmHJMZrWu8YjDwVFynuKiKwx2EkjgPezdBeodFu9qwTwTM xoeGzqnGIe+ZbxrcW6HNaD3FQ== X-Received: by 2002:a05:620a:461e:b0:92b:67e6:8acb with SMTP id af79cd13be357-92e627f80cdmr276859485a.69.1782778416870; Mon, 29 Jun 2026 17:13:36 -0700 (PDT) Received: from battery.lan (pool-138-88-31-60.washdc.fios.verizon.net. [138.88.31.60]) by smtp.gmail.com with ESMTPSA id af79cd13be357-92e6219cb9asm101975185a.21.2026.06.29.17.13.35 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 29 Jun 2026 17:13:36 -0700 (PDT) From: David Windsor To: mhiramat@kernel.org, oleg@redhat.com, peterz@infradead.org Cc: tglx@linutronix.de, mingo@redhat.com, bp@alien8.de, dave.hansen@linux.intel.com, x86@kernel.org, shuah@kernel.org, rick.p.edgecombe@intel.com, jolsa@kernel.org, linux-trace-kernel@vger.kernel.org, linux-kselftest@vger.kernel.org, linux-kernel@vger.kernel.org, David Windsor Subject: [PATCH v2 1/2] x86/uprobes: Keep shadow stack in sync for emulated CALLs Date: Mon, 29 Jun 2026 20:13:33 -0400 Message-ID: <8b5b1c7407b98f31664ad7b6a6faf20d2d4a6cad.1782777969.git.dwindsor@gmail.com> X-Mailer: git-send-email 2.53.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Uprobe CALL emulation updates the normal user stack, but not the CET user shadow stack. The subsequent RET then sees a stale shadow stack entry and raises #CP. Update the relative CALL emulation and XOL CALL fixup paths to keep the shadow stack in sync. Fixes: 488af8ea7131 ("x86/shstk: Wire in shadow stack interface") Signed-off-by: David Windsor --- v2: - propagate error from shshk_update_last_frame() rather than returning -ERESTART in default_post_xol_op(). (Oleg) v1: https://lore.kernel.org/all/20260622183109.1137245-1-dwindsor@gmail.com/ arch/x86/kernel/uprobes.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/arch/x86/kernel/uprobes.c b/arch/x86/kernel/uprobes.c index ebb1baf1eb1d..d74bb54543b6 100644 --- a/arch/x86/kernel/uprobes.c +++ b/arch/x86/kernel/uprobes.c @@ -1246,9 +1246,15 @@ static int default_post_xol_op(struct arch_uprobe *auprobe, struct pt_regs *regs long correction = utask->vaddr - utask->xol_vaddr; regs->ip += correction; } else if (auprobe->defparam.fixups & UPROBE_FIX_CALL) { + unsigned long retaddr = utask->vaddr + auprobe->defparam.ilen; + int err; + regs->sp += sizeof_long(regs); /* Pop incorrect return address */ - if (emulate_push_stack(regs, utask->vaddr + auprobe->defparam.ilen)) + if (emulate_push_stack(regs, retaddr)) return -ERESTART; + err = shstk_update_last_frame(retaddr); + if (err) + return err; } /* popf; tell the caller to not touch TF */ if (auprobe->defparam.fixups & UPROBE_FIX_SETF) @@ -1338,6 +1344,10 @@ static bool branch_emulate_op(struct arch_uprobe *auprobe, struct pt_regs *regs) */ if (emulate_push_stack(regs, new_ip)) return false; + if (shstk_push(new_ip) == -EFAULT) { + regs->sp += sizeof_long(regs); + return false; + } } else if (!check_jmp_cond(auprobe, regs)) { offs = 0; } -- 2.53.0