Fix return address hijacking with CET

[janvorli]

There is a problematic case when return address is hijacked while in a managed method that tail calls a GC write barrier and when CET is enabled. The write barrier code can change while the handler for the hijacked address is executed from the vectored exception handler. When the vectored exception handler then returns to the write barrier to re-execute the ret instruction that has triggered the vectored exception handler due to the main stack containing a different address than the shadow stack (now with the main stack fixed), the instruction may no longer be ret due to the change of the write barrier change.

This change fixes it by setting the context to return to from the vectored exception handler to point to the caller and setting the Rsp and SSP to match that. That way, the write barrier code no longer matters.

[jkotas]

Should the same change be made in naot to keep the two implementations in sync?

runtime/src/coreclr/nativeaot/Runtime/EHHelpers.cpp

Lines 551 to 556 in 061941a

	if (areShadowStacksEnabled)
	{
	// Undo the "pop", so that the ret could now succeed.
	interruptedContext->SetSp(interruptedContext->GetSp() - 8);
	interruptedContext->SetIp(origIp);
	}

[VSadov]

NativeAOT does not require the fix, but it would be better if implementations match.

LGTM, otherwise. Thanks!!

[janvorli]

I've just added commit with the nativeaot change. But I would like to know your opinion on where should the newly added GetSSP and SetSSP be.and whether they should be made a PAL API or not. Their implementation needs the windows headers to be included or the new types / API it uses redefined.

[VSadov]

I would like to know your opinion on where should the newly added GetSSP and SetSSP be.and whether they should be made a PAL API or not.

That seems fine to me. That is where I'd put the helpers as well.

[janvorli]

/backport to release/9.0-staging

[github-actions]

Started backporting to release/9.0-staging: https://github.com/dotnet/runtime/actions/runs/11686309680