diff options
| author | Richard Patel <ripatel@wii.dev> | 2026-05-18 18:39:18 +0000 |
|---|---|---|
| committer | Paul Walmsley <pjw@kernel.org> | 2026-06-06 20:17:05 -0600 |
| commit | 15b4155138505669d3d43d7692459ee8ea2a86e7 (patch) | |
| tree | baa36ce9115747e83ef66d50ada3ae12d8173b4e | |
| parent | aad60bdd0b5a6dfa40454ab03ce658408eaf4615 (diff) | |
riscv: cfi: reject unknown flags in PR_SET_CFI
prctl(PR_SET_CFI,PR_CFI_BRANCH_LANDING_PADS) silently ignored
unknown control values. Only PR_CFI_{ENABLE,DISABLE,LOCK} should
be permitted.
This changes the behavior of the uABI (fails previously accepted bits
with EINVAL).
Fixes: 08ee1559052b ("prctl: cfi: change the branch landing pad prctl()s to be more descriptive")
Signed-off-by: Richard Patel <ripatel@wii.dev>
Link: https://patch.msgid.link/20260518183918.322545-1-ripatel@wii.dev
[pjw@kernel.org: change the patch description to note that although this is a uABI change, it does not break the uABI]
Signed-off-by: Paul Walmsley <pjw@kernel.org>
| -rw-r--r-- | arch/riscv/include/asm/usercfi.h | 1 | ||||
| -rw-r--r-- | arch/riscv/kernel/usercfi.c | 3 | ||||
| -rw-r--r-- | tools/testing/selftests/riscv/cfi/cfitests.c | 6 |
3 files changed, 10 insertions, 0 deletions
diff --git a/arch/riscv/include/asm/usercfi.h b/arch/riscv/include/asm/usercfi.h index f56966edbf5c..61ee02cee297 100644 --- a/arch/riscv/include/asm/usercfi.h +++ b/arch/riscv/include/asm/usercfi.h @@ -50,6 +50,7 @@ void set_indir_lp_status(struct task_struct *task, bool enable); void set_indir_lp_lock(struct task_struct *task, bool lock); #define PR_SHADOW_STACK_SUPPORTED_STATUS_MASK (PR_SHADOW_STACK_ENABLE) +#define PR_CFI_SUPPORTED_STATUS_MASK (PR_CFI_ENABLE | PR_CFI_DISABLE | PR_CFI_LOCK) #else diff --git a/arch/riscv/kernel/usercfi.c b/arch/riscv/kernel/usercfi.c index cbfb4e495e9f..5a7113d69bad 100644 --- a/arch/riscv/kernel/usercfi.c +++ b/arch/riscv/kernel/usercfi.c @@ -467,6 +467,9 @@ int arch_prctl_set_branch_landing_pad_state(struct task_struct *t, unsigned long if (!is_user_lpad_enabled()) return -EINVAL; + if (state & ~PR_CFI_SUPPORTED_STATUS_MASK) + return -EINVAL; + /* indirect branch tracking is locked and further can't be modified by user */ if (is_indir_lp_locked(t)) return -EINVAL; diff --git a/tools/testing/selftests/riscv/cfi/cfitests.c b/tools/testing/selftests/riscv/cfi/cfitests.c index 39d097b6881f..0e3943461e7d 100644 --- a/tools/testing/selftests/riscv/cfi/cfitests.c +++ b/tools/testing/selftests/riscv/cfi/cfitests.c @@ -141,6 +141,12 @@ int main(int argc, char *argv[]) ksft_print_msg("Starting risc-v tests\n"); + /* Test unknown PR_CFI bits */ + ret = my_syscall5(__NR_prctl, PR_SET_CFI, PR_CFI_BRANCH_LANDING_PADS, + PR_CFI_ENABLE | 0xffff0, 0, 0); + if (!ret) + ksft_exit_fail_msg("PR_SET_CFI accepted reserved branch landing pad bits\n"); + /* * Landing pad test. Not a lot of kernel changes to support landing * pads for user mode except lighting up a bit in senvcfg via a prctl. |