linux-kernel - [PATCH] riscv: Disallow PR_GET_TAGGED_ADDR

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20250507145230.2272871-1-samuel.holland@sifive.com>
Date: Wed,  7 May 2025 07:52:18 -0700
From: Samuel Holland <samuel.holland@...ive.com>
To: Alexandre Ghiti <alex@...ti.fr>,
	Palmer Dabbelt <palmer@...belt.com>,
	linux-riscv@...ts.infradead.org
Cc: Samuel Holland <samuel.holland@...ive.com>,
	Albert Ou <aou@...s.berkeley.edu>,
	Bill O'Donnell <bodonnel@...hat.com>,
	Charlie Jenkins <charlie@...osinc.com>,
	Conor Dooley <conor.dooley@...rochip.com>,
	Joel Granados <joel.granados@...nel.org>,
	Paul Walmsley <paul.walmsley@...ive.com>,
	Yunhui Cui <cuiyunhui@...edance.com>,
	linux-kernel@...r.kernel.org
Subject: [PATCH] riscv: Disallow PR_GET_TAGGED_ADDR_CTRL without Supm

When the prctl() interface for pointer masking was added, it did not
check that the pointer masking ISA extension was supported, only the
individual submodes. Userspace could still attempt to disable pointer
masking and query the pointer masking state. commit 81de1afb2dd1
("riscv: Fix kernel crash due to PR_SET_TAGGED_ADDR_CTRL") disallowed
the former, as the senvcfg write could crash on older systems.
PR_GET_TAGGED_ADDR_CTRL state does not crash, because it reads only
kernel-internal state and not senvcfg, but it should still be disallowed
for consistency.

Fixes: 09d6775f503b ("riscv: Add support for userspace pointer masking")
Signed-off-by: Samuel Holland <samuel.holland@...ive.com>
---

 arch/riscv/kernel/process.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/arch/riscv/kernel/process.c b/arch/riscv/kernel/process.c
index 7c244de77180..f7a1a887ae68 100644
--- a/arch/riscv/kernel/process.c
+++ b/arch/riscv/kernel/process.c
@@ -330,6 +330,9 @@ long get_tagged_addr_ctrl(struct task_struct *task)
 	struct thread_info *ti = task_thread_info(task);
 	long ret = 0;
 
+	if (!riscv_has_extension_unlikely(RISCV_ISA_EXT_SUPM))
+		return -EINVAL;
+
 	if (is_compat_thread(ti))
 		return -EINVAL;
 
-- 
2.47.2

base-commit: 5bc1018675ec28a8a60d83b378d8c3991faa5a27
branch: up/get-tagged-addr