On Sun, Apr 27, 2025 at 07:11:43PM +0200, Oleg Nesterov wrote:
SNIP
> > +void arch_uprobe_optimize(struct arch_uprobe *auprobe, unsigned long vaddr)
> > +{
> > + struct mm_struct *mm = current->mm;
> > + uprobe_opcode_t insn[5];
> > +
> > + /*
> > + * Do not optimize if shadow stack is enabled, the return address hijack
> > + * code in arch_uretprobe_hijack_return_addr updates wrong frame when
> > + * the entry uprobe is optimized and the shadow stack crashes the app.
> > + */
> > + if (shstk_is_enabled())
> > + return;
>
> Not sure I fully understand the comment/problem, but ...
the issue is that sys_uprobe adjusts rsp to skip the uprobe trampoline stack
frame
(which is call + 3x push), so the uprobe consumers see expected stack
then if we need to hijack the return address we:
- update the return value on actual stack (updated rsp)
- we update shadow stack with shstk_update_last_frame (last shadow stack
frame)
which will cause mismatch and the app crashes on trampoline's ret
instruction
I think we could make that work, but to make it simple I think it's better
to skip it for now
> what if
> prctl(ARCH_SHSTK_ENABLE) is called after arch_uprobe_optimize() succeeds?
so that would look like this:
foo:
[int3 -> call tramp] hijack foo's return address
...
prctl(ARCH_SHSTK_ENABLE)
...
prctl(ARCH_SHSTK_DISABLE)
ret -> jumps to uretprobe trampoline
at the time 'prctl(ARCH_SHSTK_ENABLE)' is called the return address is already
hijacked/changed in any case IIUC you need to disable shadow stack before
'foo' returns
thanks,
jirka
