github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-11-07 06:17:02 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

riscv: cfi: Bounds check restore token before swap

Browse Source 
Currently the user-provided shadow stack restore token is not checked
before being used as the address in ssamoswap.d. While an invalid
restore token will be caught and raise SIGSEGV, this happens after
writing 4 bytes of zeroes anywhere in the address space. Check that the
restore token is at least a valid user address before the swap to ensure
we do not scribble over kernel memory.

Fixes: 66c9c713de ("riscv/signal: save and restore the shadow stack on a signal")
Signed-off-by: Samuel Holland <samuel.holland@sifive.com>
Link: https://patch.msgid.link/20261007155748.291814-1-samuel.holland@sifive.com
Cc: stable@vger.kernel.org
Signed-off-by: Paul Walmsley <pjw@kernel.org>
This commit is contained in:
Samuel Holland 2026-10-07 08:57:40 -07:00 committed by Paul Walmsley
parent 2cf0b29922
commit df333b72c0
1 changed files with 4 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
arch/riscv/kernel/usercfi.c
View File

@ -206,10 +206,13 @@ int save_user_shstk(struct task_struct *tsk, unsigned long *saved_shstk_ptr)
*/
int restore_user_shstk(struct task_struct *tsk, unsigned long shstk_ptr)
{
unsigned long __user *token_ptr = (unsigned long __user *)shstk_ptr;
unsigned long token = 0;
token = amo_user_shstk((unsigned long __user *)shstk_ptr, 0);
if (!access_ok(token_ptr, sizeof(token)))
return -EFAULT;
token = amo_user_shstk(token_ptr, 0);
if (token == -1)
return -EFAULT;