[PATCH] riscv: ptrace: Zero-initialize regset buffers before copyin

[PATCH] riscv: ptrace: Zero-initialize regset buffers before copyin

[Zongmin Zhou]

From: Zongmin Zhou <zhouzongmin@kylinos.cn>

user_regset_copyin() only copies `count` bytes, so a PTRACE_SETREGSET
request with a short iov_len leaves the rest of the stack buffer
uninitialized. In riscv_vr_set() that garbage is validated and copied
into the target's vstate, and in riscv_cfi_set() it can be stored as
the target's shadow stack pointer. Zero both buffers, as the get path
already does.

Fixes: 9300f0043974 ("RISC-V: Add ptrace support for vectors")
Fixes: 2af7c9cf021c ("riscv/ptrace: expose riscv CFI status and state via ptrace and in core files")
Signed-off-by: Zongmin Zhou <zhouzongmin@kylinos.cn>
---
 arch/riscv/kernel/ptrace.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/arch/riscv/kernel/ptrace.c b/arch/riscv/kernel/ptrace.c
index f336a183667e..e089dd192b13 100644
--- a/arch/riscv/kernel/ptrace.c
+++ b/arch/riscv/kernel/ptrace.c
@@ -230,6 +230,7 @@ static int riscv_vr_set(struct task_struct *target,
 		return -ENODATA;
 
 	/* Copy rest of the vstate except datap */
+	memset(&ptrace_vstate, 0, sizeof(ptrace_vstate));
 	ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf, &ptrace_vstate, 0,
 				 sizeof(struct __riscv_v_regset_state));
 	if (unlikely(ret))
@@ -339,6 +340,7 @@ static int riscv_cfi_set(struct task_struct *target,
 
 	regs = task_pt_regs(target);
 
+	memset(&user_cfi, 0, sizeof(user_cfi));
 	ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf, &user_cfi, 0, -1);
 	if (ret)
 		return ret;
-- 
2.34.1


No virus found
		Checked by Hillstone Network AntiVirus

Re: [PATCH] riscv: ptrace: Zero-initialize regset buffers before copyin

[Paul Walmsley]

On Wed, 26 Aug 2026, Zongmin Zhou wrote:

> From: Zongmin Zhou <zhouzongmin@kylinos.cn>
> 
> user_regset_copyin() only copies `count` bytes, so a PTRACE_SETREGSET
> request with a short iov_len leaves the rest of the stack buffer
> uninitialized. In riscv_vr_set() that garbage is validated and copied
> into the target's vstate, and in riscv_cfi_set() it can be stored as
> the target's shadow stack pointer. Zero both buffers, as the get path
> already does.
> 
> Fixes: 9300f0043974 ("RISC-V: Add ptrace support for vectors")
> Fixes: 2af7c9cf021c ("riscv/ptrace: expose riscv CFI status and state via ptrace and in core files")
> Signed-off-by: Zongmin Zhou <zhouzongmin@kylinos.cn>

Thanks, queued for v7.3-rc.


- Paul