x86/cet: Fix shskt manipulation error with BUGFRAME_{warn,run_fn}
authorAndrew Cooper <andrew.cooper3@citrix.com>
Thu, 12 Aug 2021 16:39:16 +0000 (17:39 +0100)
committerAndrew Cooper <andrew.cooper3@citrix.com>
Mon, 16 Aug 2021 15:03:20 +0000 (16:03 +0100)
commit35727551c0703493a2240e967cffc3063b13d49c
tree2f63b25010f95c5bbc1de33ee9c63388bdd99074
parentbc141e8ca56200bdd0a12e04a6ebff3c19d6c27b
x86/cet: Fix shskt manipulation error with BUGFRAME_{warn,run_fn}

This was a clear oversight in the original CET work.  The BUGFRAME_run_fn and
BUGFRAME_warn paths update regs->rip without an equivalent adjustment to the
shadow stack, causing IRET to suffer #CP because of the mismatch.

One subtle, and therefore fragile, aspect of extable_shstk_fixup() was that it
required regs->rip to have its old value as a cross-check that the right word
in the shadow stack was being edited.

Rework extable_shstk_fixup() into fixup_exception_return() which takes
ownership of the update to both the regular and shadow stacks, ensuring that
the regs->rip update is ordered correctly.

Use the new fixup_exception_return() for BUGFRAME_run_fn and BUGFRAME_warn to
ensure that the shadow stack is updated too.

Fixes: 209fb9919b50 ("x86/extable: Adjust extable handling to be shadow stack compatible")
Reported-by: Marek Marczykowski-Górecki <marmarek@invisiblethingslab.com>
Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Tested-by: Marek Marczykowski-Górecki <marmarek@invisiblethingslab.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>
xen/arch/x86/traps.c