Skip to content

[PW_SID:1096809] riscv: cfi: reject unknown flags in PR_SET_CFI #1966

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
linux-riscv-bot wants to merge 1 commit into from
Closed

[PW_SID:1096809] riscv: cfi: reject unknown flags in PR_SET_CFI #1966

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions arch/riscv/include/asm/usercfi.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -50,6 +50,7 @@ void set_indir_lp_status(struct task_struct *task, bool enable);
void set_indir_lp_lock(struct task_struct *task, bool lock);

#define PR_SHADOW_STACK_SUPPORTED_STATUS_MASK (PR_SHADOW_STACK_ENABLE)
#define PR_CFI_SUPPORTED_STATUS_MASK (PR_CFI_ENABLE | PR_CFI_DISABLE | PR_CFI_LOCK)

#else

Expand Down
3 changes: 3 additions & 0 deletions arch/riscv/kernel/usercfi.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -467,6 +467,9 @@ int arch_prctl_set_branch_landing_pad_state(struct task_struct *t, unsigned long
if (!is_user_lpad_enabled())
return -EINVAL;

if (state & ~PR_CFI_SUPPORTED_STATUS_MASK)
return -EINVAL;

/* indirect branch tracking is locked and further can't be modified by user */
if (is_indir_lp_locked(t))
return -EINVAL;
Expand Down
6 changes: 6 additions & 0 deletions tools/testing/selftests/riscv/cfi/cfitests.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -141,6 +141,12 @@ int main(int argc, char *argv[])

ksft_print_msg("Starting risc-v tests\n");

/* Test unknown PR_CFI bits */
ret = my_syscall5(__NR_prctl, PR_SET_CFI, PR_CFI_BRANCH_LANDING_PADS,
PR_CFI_ENABLE | 0xffff0, 0, 0);
if (!ret)
ksft_exit_fail_msg("PR_SET_CFI accepted reserved branch landing pad bits\n");

/*
* Landing pad test. Not a lot of kernel changes to support landing
* pads for user mode except lighting up a bit in senvcfg via a prctl.
Expand Down