diff options
| author | Jérémy Jean <Jeremy.Jean@oss.cyber.gouv.fr> | 2026-08-21 10:30:27 +0000 |
|---|---|---|
| committer | Michal Simek <michal.simek@amd.com> | 2026-09-01 15:11:09 +0200 |
| commit | 8518fd17ccef4a7d77877ccb0403b722106ad1a4 (patch) | |
| tree | 95ef01a16bad1378d3c1fbd662afa4fa1eb23a66 /tools/perf/scripts/python | |
| parent | aeedf85beac51c7cd8f7bf4c918a0104dfdb8b78 (diff) | |
microblaze: prevent ptrace writes to MSR and pt_mode
arch_ptrace() accepts PTRACE_POKEUSR for every aligned offset below
PT_SIZE. This includes the saved machine status register and pt_mode,
which are kernel-owned execution state rather than general registers.
On return from an exception, rtbd copies MSR_UMS to the live MSR_UM bit.
An unprivileged same-UID tracer can therefore clear MSR_UMS in its
tracee's saved register frame and make the tracee resume in supervisor
mode. pt_mode also controls whether later entry paths classify the frame
as kernel or user state.
Reject PTRACE_POKEUSR writes to both fields while retaining read access.
Fixes: 2b4384542691 ("microblaze_v8: ptrace support")
Assisted-by: Codex:gpt-5
Signed-off-by: Jérémy Jean <Jeremy.Jean@oss.cyber.gouv.fr>
Link: https://patch.msgid.link/20260821103026.3627292-2-Jeremy.Jean@oss.cyber.gouv.fr
Signed-off-by: Michal Simek <michal.simek@amd.com>
Diffstat (limited to 'tools/perf/scripts/python')
0 files changed, 0 insertions, 0 deletions
