On Mon, Jun 22, 2026 at 02:31:08PM -0400, David Windsor wrote:
> Uprobe CALL emulation updates the normal user stack, but not the CET user
> shadow stack. The subsequent RET then sees a stale shadow stack entry and
> raises #CP.
>
> Update the relative CALL emulation and XOL CALL fixup paths to keep the
> shadow stack in sync.
>
> Fixes: 488af8ea7131 ("x86/shstk: Wire in shadow stack interface")
I can confirm this patch fixes the included test case, so yay for that.
However, should this not be:
Fixes: 1713b63a07a2 ("x86/shstk: Make return uprobe work with shadow stack")
?
> Signed-off-by: David Windsor <[email protected]>
> ---
> arch/x86/kernel/uprobes.c | 10 +++++++++-
> 1 file changed, 9 insertions(+), 1 deletion(-)
>
> diff --git a/arch/x86/kernel/uprobes.c b/arch/x86/kernel/uprobes.c
> index ebb1baf1eb1d..ae32013a7097 100644
> --- a/arch/x86/kernel/uprobes.c
> +++ b/arch/x86/kernel/uprobes.c
> @@ -1246,8 +1246,12 @@ static int default_post_xol_op(struct arch_uprobe
> *auprobe, struct pt_regs *regs
> long correction = utask->vaddr - utask->xol_vaddr;
> regs->ip += correction;
> } else if (auprobe->defparam.fixups & UPROBE_FIX_CALL) {
> + unsigned long retaddr = utask->vaddr + auprobe->defparam.ilen;
> +
> regs->sp += sizeof_long(regs); /* Pop incorrect return address
> */
> - if (emulate_push_stack(regs, utask->vaddr +
> auprobe->defparam.ilen))
> + if (emulate_push_stack(regs, retaddr))
> + return -ERESTART;
> + if (shstk_update_last_frame(retaddr))
> return -ERESTART;
> }
> /* popf; tell the caller to not touch TF */
> @@ -1338,6 +1342,10 @@ static bool branch_emulate_op(struct arch_uprobe
> *auprobe, struct pt_regs *regs)
> */
> if (emulate_push_stack(regs, new_ip))
> return false;
> + if (shstk_push(new_ip) == -EFAULT) {
> + regs->sp += sizeof_long(regs);
> + return false;
> + }
> } else if (!check_jmp_cond(auprobe, regs)) {
> offs = 0;
> }
> --
> 2.43.0
