On 28/01/2026 02:09, Jinjie Ruan wrote: > > On 2026/1/27 23:06, Kevin Brodsky wrote: >> On 27/01/2026 12:34, Jinjie Ruan wrote: >>>> [...] >>>> >>>>> I'm also concerned that rseq_debug_update_user_cs() >>>>> operates on instruction_pointer(regs) which is something that can be >>>>> chaned by ptrace. >>>> Isn't that true regardless of where rseq_syscall() is called on the >>>> syscall exit path, though? >>> My understanding is that if instruction_pointer(regs) is hijacked and >>> modified via ptrace at the syscall exit (ptrace_report_syscall_exit()), >>> this modification will not be observed by rseq. Specifically, in the >>> generic entry syscall exit path, rseq_syscall() is unable to detect such >>> a PC modification. >> Good point. So concretely that means that currently on arm64, one could >> make the rseq debug check pass/fail by using the syscall exit trap to >> modify PC. OTOH this is impossible with generic entry because the rseq >> check is performed first. I'm not sure this is a feature anyone has even >> noticed, but it is a user-visible change indeed. > After digging into the ptrace code, I found that ptrace does not modify > instruction_pointer(regs) on the syscall exit path; it only changes the > return value as below. > Therefore, if my understanding is correct, Will's concern does not apply > here. > > ptrace_set_syscall_info() > -> ptrace_set_syscall_info_exit() > -> syscall_set_return_value(child, regs, 0, rval)
I'm not following, how is that related to the call to ptrace_report_syscall_exit()? That eventually results in a call to ptrace_stop() (via ptrace_notify()), which synchronously causes the tracee to sleep and allows the tracer to issue ptrace commands, e.g. setting PC. - Kevin
