diff options
| author | Zongmin Zhou <zhouzongmin@kylinos.cn> | 2026-08-26 19:57:11 +0800 |
|---|---|---|
| committer | Paul Walmsley <pjw@kernel.org> | 2026-10-07 10:44:54 -0600 |
| commit | 59052a88ba5fe4a7bb34b3a0a42aa5d453d3bb97 (patch) | |
| tree | cbe4a839dc4196fb1dad934f4bb696ffaeff9832 /arch/riscv | |
| parent | adadf6df0bd55aa40ccbc6519fb443133e103227 (diff) | |
riscv: ptrace: Zero-initialize regset buffers before copyin
user_regset_copyin() only copies `count` bytes, so a PTRACE_SETREGSET
request with a short iov_len leaves the rest of the stack buffer
uninitialized. In riscv_vr_set() that garbage is validated and copied
into the target's vstate, and in riscv_cfi_set() it can be stored as
the target's shadow stack pointer. Zero both buffers, as the get path
already does.
Fixes: 9300f0043974 ("RISC-V: Add ptrace support for vectors")
Fixes: 2af7c9cf021c ("riscv/ptrace: expose riscv CFI status and state via ptrace and in core files")
Signed-off-by: Zongmin Zhou <zhouzongmin@kylinos.cn>
Link: https://patch.msgid.link/20260826115711.86861-1-min_halo@163.com
Signed-off-by: Paul Walmsley <pjw@kernel.org>
Diffstat (limited to 'arch/riscv')
| -rw-r--r-- | arch/riscv/kernel/ptrace.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/arch/riscv/kernel/ptrace.c b/arch/riscv/kernel/ptrace.c index 566856e42f65..a0055743d3ba 100644 --- a/arch/riscv/kernel/ptrace.c +++ b/arch/riscv/kernel/ptrace.c @@ -230,6 +230,7 @@ static int riscv_vr_set(struct task_struct *target, return -ENODATA; /* Copy rest of the vstate except datap */ + memset(&ptrace_vstate, 0, sizeof(ptrace_vstate)); ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf, &ptrace_vstate, 0, sizeof(struct __riscv_v_regset_state)); if (unlikely(ret)) @@ -345,6 +346,7 @@ static int riscv_cfi_set(struct task_struct *target, regs = task_pt_regs(target); + memset(&user_cfi, 0, sizeof(user_cfi)); ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf, &user_cfi, 0, -1); if (ret) return ret; |