[PATCH 0/2] arm64: signal: Fix ZT restore without ZA and clean up bounds check

[PATCH 0/2] arm64: signal: Fix ZT restore without ZA and clean up bounds check

[Bradley Morgan]

This series addresses two separate issues in the arm64 signal frame
parsing and restoration code:

Patch 1 fixes a bug where ZT state could be restored without ZA state.
If user.za was omitted from the signal frame, restore_za_context() was
never invoked. When a signal handler touched SME before calling
rt_sigreturn(), thread_za_enabled(&current->thread) evaluated to true,
causing restore_zt_context() to overwrite ZT without restoring ZA.
We now mandate that user->za is present before restoring ZT context.

Patch 2 drops a duplicate limit - offset < size bounds check in
parse_user_sigframe() that was left over after the switch block from the
2017 frame layout rework.

Bradley Morgan (2):
  arm64/fpsimd: signal: Require ZA context when restoring ZT context
  arm64: signal: drop redundant bounds check in parse_user_sigframe()

 arch/arm64/kernel/signal.c | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

-- 
2.53.0

[PATCH 1/2] arm64/fpsimd: signal: Require ZA context when restoring ZT context

[Bradley Morgan]

When restoring the signal frame, restore_zt_context() checks whether ZA
is enabled via thread_za_enabled(&current->thread). However, if user.za
is omitted from the signal frame, restore_za_context() is skipped entirely.
If the signal handler touched SME prior to rt_sigreturn(), ZA remains
enabled in current->thread.svcr from the handler context, causing
thread_za_enabled() to succeed and restore_zt_context() to write userspace
ZT data without restoring ZA state.

Require user->za to be present in the signal frame before restoring ZT.

Fixes: ee072cf70804 ("arm64/sme: Implement signal handling for ZT")
Cc: stable@vger.kernel.org
Signed-off-by: Bradley Morgan <bradley.morgan@linux.dev>
---
 arch/arm64/kernel/signal.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm64/kernel/signal.c b/arch/arm64/kernel/signal.c
index 6a06a4e352b1d..20d5f19921e0d 100644
--- a/arch/arm64/kernel/signal.c
+++ b/arch/arm64/kernel/signal.c
@@ -678,7 +678,7 @@ static int restore_zt_context(struct user_ctxs *user)
 	u16 nregs;
 
 	/* ZA must be restored first for this check to be valid */
-	if (!thread_za_enabled(&current->thread))
+	if (!user->za || !thread_za_enabled(&current->thread))
 		return -EINVAL;
 
 	if (user->zt_size != ZT_SIG_CONTEXT_SIZE(1))
-- 
2.53.0

[PATCH 2/2] arm64: signal: drop redundant bounds check in parse_user_sigframe()

[Bradley Morgan]

We already check limit - offset < size right after reading head->size
before the magic switch. Then once the switch finishes, we turn around
and check the exact same thing again.

None of the switch cases touch offset, limit, or size before reaching
the bottom, and extra context branches off with continue anyway. So the
second check is completely dead. It has been sitting here since the 2017
frame layout rework.

Drop the duplicate check.

Signed-off-by: Bradley Morgan <bradley.morgan@linux.dev>
---
 arch/arm64/kernel/signal.c | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/arch/arm64/kernel/signal.c b/arch/arm64/kernel/signal.c
index 20d5f19921e0d..d152735d632e5 100644
--- a/arch/arm64/kernel/signal.c
+++ b/arch/arm64/kernel/signal.c
@@ -1003,9 +1003,6 @@ static int parse_user_sigframe(struct user_ctxs *user,
 		if (size < sizeof(*head))
 			goto invalid;
 
-		if (limit - offset < size)
-			goto invalid;
-
 		offset += size;
 	}
 
-- 
2.53.0