From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from out30-133.freemail.mail.aliyun.com (out30-133.freemail.mail.aliyun.com [115.124.30.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id F31082DECA1 for ; Thu, 20 Aug 2026 06:32:40 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=115.124.30.133 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787207563; cv=none; b=sZXEx3n0uGPfwu/WK0k0Gp4a/X5Piuwvj/sw/f5InE8f/l5U0ZRzUoDMb7RNgP5NM+tJGR5mYk5Cj36OqSTyqmVGP7pa/yvmOLNwFOXQ8iy2Ubue9Mvnv8KJarsataQzZK4mK99c1ChkD0AQp2m5FVvBaJfraSxGGS8UjCHNDj0= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787207563; c=relaxed/simple; bh=PBdN0rrEYuLWCm1Zg3+LcLL02Ri72UU15L2GyqQLFSI=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=gGqtQcL7SqYRt7KnsEPlaUkj0efBb29Pz+bcttJN/7DYS9F36RNFZaYnBEtkjjq0H/i6l6Hoao8aaSQJzCByhUnYsb9fQwKC0qXJBcIDNs+DJ6yGoiZDBfTBu71UiQY/5f5ccCOD22y+TvcoHbKElN3SCCy4ojPvA8K4Vvzb8LY= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.alibaba.com; spf=pass smtp.mailfrom=linux.alibaba.com; dkim=pass (1024-bit key) header.d=linux.alibaba.com header.i=@linux.alibaba.com header.b=q8gBpXxh; arc=none smtp.client-ip=115.124.30.133 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.alibaba.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.alibaba.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.alibaba.com header.i=@linux.alibaba.com header.b="q8gBpXxh" DKIM-Signature:v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.alibaba.com; s=default; t=1787207558; h=From:To:Subject:Date:Message-ID:MIME-Version; bh=fRDiUOb4sl6PTw3ZuPzglrAV+gTsQrGltoxvCxRLMco=; b=q8gBpXxhAl3euGnnKN6/7PZ2eLLZafhMb3TJ8AsrVKWlYxjvvGmAyb/r5MecOX8m41pezJlvNC045+j5Jd1D/wtmsOiBODVIIHQC2fAKbyUzOUk4M716wX38ZvhAWTO5Qsd7bITuoipNZhIIYjcs7UGK35Tem4il64HvgwrL1bA= X-Alimail-AntiSpam:AC=PASS;BC=-1|-1;BR=01201311R101e4;CH=green;DM=||false|;DS=||;FP=0|-1|-1|-1|0|-1|-1|-1;HT=maildocker-contentspam033037026112;MF=cp0613@linux.alibaba.com;NM=1;PH=DS;RN=7;SR=0;TI=SMTPD_---0X9IUrkU_1787207553; Received: from DESKTOP-S9E58SO.localdomain(mailfrom:cp0613@linux.alibaba.com fp:SMTPD_---0X9IUrkU_1787207553 cluster:ay36) by smtp.aliyun-inc.com; Thu, 20 Aug 2026 14:32:37 +0800 From: Chen Pei To: pjw@kernel.org, oleg@redhat.com, debug@rivosinc.com Cc: alex@ghiti.fr, guoren@kernel.org, linux-riscv@lists.infradead.org, linux-kernel@vger.kernel.org Subject: [PATCH] riscv: ptrace: reject CFI regset access when extensions are absent Date: Thu, 20 Aug 2026 14:32:33 +0800 Message-ID: <20260820063233.2567-1-cp0613@linux.alibaba.com> X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit riscv_cfi_get() and riscv_cfi_set() do not check whether the Zicfilp or Zicfiss extensions are present. On systems without them, PTRACE_GETREGSET on REGSET_CFI still succeeds and returns a zeroed user_cfi_state, misleading debuggers into believing the register set is available, and PTRACE_SETREGSET silently accepts writes that have no effect (e.g. clearing SR_ELP). Reject the access with -EINVAL when neither branch landing pads nor shadow stack is available to userspace, using the same availability helpers as the prctl path. Fixes: 2af7c9cf021c ("riscv/ptrace: expose riscv CFI status and state via ptrace and in core files") Signed-off-by: Chen Pei --- This follows the behaviour of the arm64 GCS regset. Unlike vector registers, no ENODATA case applies here: the CFI status regset has a valid all-zero representation even when CFI has not been enabled for the traced task. is_user_lpad_enabled()/is_user_shstk_enabled() are used instead of a plain ISA check so that the regset visibility matches what userspace can actually use via prctl: both helpers also honor the riscv_nousercfi kernel command line switch. arch/riscv/kernel/ptrace.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/arch/riscv/kernel/ptrace.c b/arch/riscv/kernel/ptrace.c index f336a183667e..566856e42f65 100644 --- a/arch/riscv/kernel/ptrace.c +++ b/arch/riscv/kernel/ptrace.c @@ -299,6 +299,9 @@ static int riscv_cfi_get(struct task_struct *target, struct user_cfi_state user_cfi; struct pt_regs *regs; + if (!is_user_lpad_enabled() && !is_user_shstk_enabled()) + return -EINVAL; + memset(&user_cfi, 0, sizeof(user_cfi)); regs = task_pt_regs(target); @@ -337,6 +340,9 @@ static int riscv_cfi_set(struct task_struct *target, struct user_cfi_state user_cfi; struct pt_regs *regs; + if (!is_user_lpad_enabled() && !is_user_shstk_enabled()) + return -EINVAL; + regs = task_pt_regs(target); ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf, &user_cfi, 0, -1); -- 2.50.1