[PATCH] riscv: cfi: reject unknown flags in PR_SET_CFI

[Richard Patel]

prctl(PR_SET_CFI,PR_CFI_BRANCH_LANDING_PADS) silently ignored
unknown control values. Only PR_CFI_{ENABLE,DISABLE,LOCK} should
be permitted.

This is a uABI breaking change (fails previously accepted bits
with EINVAL).

Fixes: 08ee1559052b ("prctl: cfi: change the branch landing pad prctl()s to be 
more descriptive")
Signed-off-by: Richard Patel <ripa...@wii.dev>
---
 arch/riscv/include/asm/usercfi.h             | 1 +
 arch/riscv/kernel/usercfi.c                  | 3 +++
 tools/testing/selftests/riscv/cfi/cfitests.c | 6 ++++++
 3 files changed, 10 insertions(+)

diff --git a/arch/riscv/include/asm/usercfi.h b/arch/riscv/include/asm/usercfi.h
index f56966edbf5c..61ee02cee297 100644
--- a/arch/riscv/include/asm/usercfi.h
+++ b/arch/riscv/include/asm/usercfi.h
@@ -50,6 +50,7 @@ void set_indir_lp_status(struct task_struct *task, bool 
enable);
 void set_indir_lp_lock(struct task_struct *task, bool lock);
 
 #define PR_SHADOW_STACK_SUPPORTED_STATUS_MASK (PR_SHADOW_STACK_ENABLE)
+#define PR_CFI_SUPPORTED_STATUS_MASK (PR_CFI_ENABLE | PR_CFI_DISABLE | 
PR_CFI_LOCK)
 
 #else
 
diff --git a/arch/riscv/kernel/usercfi.c b/arch/riscv/kernel/usercfi.c
index cbfb4e495e9f..5a7113d69bad 100644
--- a/arch/riscv/kernel/usercfi.c
+++ b/arch/riscv/kernel/usercfi.c
@@ -467,6 +467,9 @@ int arch_prctl_set_branch_landing_pad_state(struct 
task_struct *t, unsigned long
        if (!is_user_lpad_enabled())
                return -EINVAL;
 
+       if (state & ~PR_CFI_SUPPORTED_STATUS_MASK)
+               return -EINVAL;
+
        /* indirect branch tracking is locked and further can't be modified by 
user */
        if (is_indir_lp_locked(t))
                return -EINVAL;
diff --git a/tools/testing/selftests/riscv/cfi/cfitests.c 
b/tools/testing/selftests/riscv/cfi/cfitests.c
index 39d097b6881f..0e3943461e7d 100644
--- a/tools/testing/selftests/riscv/cfi/cfitests.c
+++ b/tools/testing/selftests/riscv/cfi/cfitests.c
@@ -141,6 +141,12 @@ int main(int argc, char *argv[])
 
        ksft_print_msg("Starting risc-v tests\n");
 
+       /* Test unknown PR_CFI bits */
+       ret = my_syscall5(__NR_prctl, PR_SET_CFI, PR_CFI_BRANCH_LANDING_PADS,
+                         PR_CFI_ENABLE | 0xffff0, 0, 0);
+       if (!ret)
+               ksft_exit_fail_msg("PR_SET_CFI accepted reserved branch landing 
pad bits\n");
+
        /*
         * Landing pad test. Not a lot of kernel changes to support landing
         * pads for user mode except lighting up a bit in senvcfg via a prctl.
-- 
2.47.3