Messages in this thread Patch in this message |  | | From | Michael Neuling <> | | Subject | [PATCH 2/5] riscv: ptrace: Fix register corruption in compat_riscv_gpr_set on error | | Date | Thu, 9 Apr 2026 09:11:40 +0000 |
| |
compat_riscv_gpr_set() calls cregs_to_regs() unconditionally, even when user_regset_copyin() fails. Since cregs is an uninitialized stack variable, a copyin failure causes uninitialized stack data to be written into the target task's pt_regs, corrupting its register state and potentially leaking kernel stack contents.
Only call cregs_to_regs() when user_regset_copyin() succeeds.
Fixes: 4608c15959 ("riscv: compat: ptrace: Add compat_arch_ptrace implement") Signed-off-by: Michael Neuling <mikey@neuling.org> Assisted-by: Cursor:claude-4.6-opus-high-thinking --- arch/riscv/kernel/ptrace.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/arch/riscv/kernel/ptrace.c b/arch/riscv/kernel/ptrace.c index 93de2e7a30..793bcee461 100644 --- a/arch/riscv/kernel/ptrace.c +++ b/arch/riscv/kernel/ptrace.c @@ -577,8 +577,8 @@ static int compat_riscv_gpr_set(struct task_struct *target, struct compat_user_regs_struct cregs; ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf, &cregs, 0, -1); - - cregs_to_regs(&cregs, task_pt_regs(target)); + if (!ret) + cregs_to_regs(&cregs, task_pt_regs(target)); return ret; } -- 2.43.0
|  |