linux-kernel - [PATCH] riscv: uaccess: Only restore the CSR

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20250522160954.429333-1-cyrilbur@tenstorrent.com>
Date: Thu, 22 May 2025 16:09:54 +0000
From: Cyril Bur <cyrilbur@...storrent.com>
To: samuel.holland@...ive.com,
	ben.dooks@...ethink.co.uk,
	palmer@...belt.com,
	alex@...ti.fr,
	linux-kernel@...r.kernel.org
Cc: jszhang@...nel.org,
	paul.walmsley@...ive.com,
	charlie@...osinc.com,
	jrtc27@...c27.com,
	aou@...s.berkeley.edu
Subject: [PATCH] riscv: uaccess: Only restore the CSR_STATUS SUM bit

During switch to csrs will OR the value of the register into the
corresponding csr. In this case we're only interested in restoring the
SUM bit not the entire register.

Fixes: 788aa64c0 ("riscv: save the SR_SUM status over switches")
Signed-off-by: Cyril Bur <cyrilbur@...storrent.com>
---
I've put the Fixes tag in but I assume this will get squashed into the
patch. Either way I hope this works to fix the immediate issue.

 arch/riscv/kernel/entry.S | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/arch/riscv/kernel/entry.S b/arch/riscv/kernel/entry.S
index 00bd0de9faa2..6ed3bd80903d 100644
--- a/arch/riscv/kernel/entry.S
+++ b/arch/riscv/kernel/entry.S
@@ -399,14 +399,18 @@ SYM_FUNC_START(__switch_to)
 	REG_S s11, TASK_THREAD_S11_RA(a3)
 
 	/* save the user space access flag */
-	li    s0, SR_SUM
-	csrr  s1, CSR_STATUS
-	REG_S s1, TASK_THREAD_STATUS_RA(a3)
+	csrr  s0, CSR_STATUS
+	REG_S s0, TASK_THREAD_STATUS_RA(a3)
 
 	/* Save the kernel shadow call stack pointer */
 	scs_save_current
-	/* Restore context from next->thread */
+	/*
+	 * Restore context from next->thread. csrs will OR the bits from s0 and
+	 * only want to restore the SR_SUM bit
+	 */
 	REG_L s0,  TASK_THREAD_STATUS_RA(a4)
+	li    s1,  SR_SUM
+	and   s0,  s0, s1
 	csrs  CSR_STATUS, s0
 	REG_L ra,  TASK_THREAD_RA_RA(a4)
 	REG_L sp,  TASK_THREAD_SP_RA(a4)
-- 
2.34.1