Re: [PATCH] x86/entry/32: Harden return-to-user

[Andrey Zakharov]

Hi Dave,

Thanks for the pointers. I looked at the list in 4dab5fe58904 and at
kss-2026-10-23 (b6fa923e47fc). This is code reading and builds only: I
have no FRED hardware, so nothing below was run.

Build problems in kss-2026-10-23:

 - "make defconfig" (X86_CET=y via X86_KERNEL_IBT, X86_USER_SHADOW_STACK
   unset) fails in arch/x86/kernel/cet.c with gcc 16.2.1:
     :277 no previous prototype for 'kshstk_build'
     :330 redefinition of 'arch_kernel_stack_lock_current'
     :351 'struct thread_struct' has no member named 'kshstk_ssp'
     :351 implicit declaration of 'kshstk_enable_current'
   cet.c has no #ifdef, while the declarations in asm/shstk.h sit under
   CONFIG_X86_USER_SHADOW_STACK. Only cet.o was built for defconfig.
 - With USER and KERN shadow stacks both =y, vmlinux.o gets an objtool
   warning: kshstk_enable_current+0x3: call to kshstk_build() leaves
   .noinstr.text section (it is in .entry.text, kshstk_build is in .text).

A question: PUSH/POP_KERNEL_EVENT_SSP in entry_64_fred.S are under
CONFIG_X86_USER_SHADOW_STACK, but regs_set_return_ip() depends on
X86_FEATURE_KERN_SHSTK. With KERN=y and USER=n no slot would be pushed,
and regs_set_return_ip() would read the word below pt_regs. Should the
macros depend on X86_KERN_SHADOW_STACK? That config does not build
today, so this is from reading only.

Direct writes to regs->ip in kernel-event paths, as far as I read them
(as I understand it, ERETS compares the shadow stack LIP with RIP on the
regular stack; please correct me if that is wrong):

 - traps.c, handle_bug(): regs->ip += ud_len or = addr, so every handled
   WARN() goes through it.
 - alternative.c, FineIBT decoding (two places): regs->ip = *target.
 - text-patching.h, int3_emulate_jmp(), used by int3_emulate_call/ret;
   callers are in smp_text_poke_int3_handler() (ret, call, jmp, jcc).
   int3_emulate_push/pop only touch regs->sp and the regular stack.
   Emulation is reached from jump_label.c (JMP; NOP5 is emulated as
   JMP32+0), ftrace.c (CALL/JMP32) and static_call.c.
 - kgdb: kgdb_arch_set_pc(), the 'c'/'s' commands with an address,
   kgdb_skipexception(), and dbg_set_reg(), which memcpy()s into
   pt_regs (ip, cs, flags) through dbg_reg_def.

smp_text_poke_int3_handler() is noinstr and must not call out. cet.c has
no noinstr/notrace and is not removed from -pg in the Makefile, so
calling regs_set_return_ip() from there as it is looks unsafe.

I found no caller of arch_kernel_stack_lock_current() yet. If it ends up
before alternative_instructions(), int3_selftest() would run an emulated
call with shadow stacks on.

Not checked: runtime behaviour, whether these paths are reachable in
practice, other writers of regs->ip (tdx, vc-shared, mm/fault.c were not
read).

Thanks,
Andrey