Hi Nam,
On 04/05/2025 12:19, Nam Cao wrote:
When userspace does PR_SET_TAGGED_ADDR_CTRL, but Supm extension is not available, the kernel crashes:
Oops - illegal instruction [#1] [snip] epc : set_tagged_addr_ctrl+0x112/0x15a ra : set_tagged_addr_ctrl+0x74/0x15a epc : ffffffff80011ace ra : ffffffff80011a30 sp : ffffffc60039be10 [snip] status: 0000000200000120 badaddr: 0000000010a79073 cause: 0000000000000002 set_tagged_addr_ctrl+0x112/0x15a __riscv_sys_prctl+0x352/0x73c do_trap_ecall_u+0x17c/0x20c andle_exception+0x150/0x15c
It seems like the csr write is triggering this illegal instruction, can you confirm it is? If so, I can't find in the specification that an implementation should do that when writing envcfg and I can't reproduce it on qemu. Where did you see this oops?
Thanks,
Alex
Fix it by checking if Supm is available.
Fixes: 09d6775f503b ("riscv: Add support for userspace pointer masking") Signed-off-by: Nam Cao namcao@linutronix.de Cc: stable@vger.kernel.org
arch/riscv/kernel/process.c | 3 +++ 1 file changed, 3 insertions(+)
diff --git a/arch/riscv/kernel/process.c b/arch/riscv/kernel/process.c index 7c244de77180..3db2c0c07acd 100644 --- a/arch/riscv/kernel/process.c +++ b/arch/riscv/kernel/process.c @@ -275,6 +275,9 @@ long set_tagged_addr_ctrl(struct task_struct *task, unsigned long arg) unsigned long pmm; u8 pmlen;
- if (!riscv_has_extension_unlikely(RISCV_ISA_EXT_SUPM))
return -EINVAL;- if (is_compat_thread(ti)) return -EINVAL;