From df333b72c0e14d6cffec72ce9a00503f12d1e28d Mon Sep 17 00:00:00 2001 From: Samuel Holland Date: Wed, 7 Oct 2026 08:57:40 -0700 Subject: [PATCH] riscv: cfi: Bounds check restore token before swap Currently the user-provided shadow stack restore token is not checked before being used as the address in ssamoswap.d. While an invalid restore token will be caught and raise SIGSEGV, this happens after writing 4 bytes of zeroes anywhere in the address space. Check that the restore token is at least a valid user address before the swap to ensure we do not scribble over kernel memory. Fixes: 66c9c713de59 ("riscv/signal: save and restore the shadow stack on a signal") Signed-off-by: Samuel Holland Link: https://patch.msgid.link/20261007155748.291814-1-samuel.holland@sifive.com Cc: stable@vger.kernel.org Signed-off-by: Paul Walmsley --- arch/riscv/kernel/usercfi.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/arch/riscv/kernel/usercfi.c b/arch/riscv/kernel/usercfi.c index dec0ba5eff5e..23c4d6d9d8cb 100644 --- a/arch/riscv/kernel/usercfi.c +++ b/arch/riscv/kernel/usercfi.c @@ -206,10 +206,13 @@ int save_user_shstk(struct task_struct *tsk, unsigned long *saved_shstk_ptr) */ int restore_user_shstk(struct task_struct *tsk, unsigned long shstk_ptr) { + unsigned long __user *token_ptr = (unsigned long __user *)shstk_ptr; unsigned long token = 0; - token = amo_user_shstk((unsigned long __user *)shstk_ptr, 0); + if (!access_ok(token_ptr, sizeof(token))) + return -EFAULT; + token = amo_user_shstk(token_ptr, 0); if (token == -1) return -EFAULT;