[PATCH] riscv: cfi: Bounds check restore token in create_rstor_token() before swap

[Tobias Klauser]

create_rstor_token() computes addr and passes it to amo_user_shstk(),
which executes ssamoswap.d on it under __enable_user_access() without
ever validating that addr is a legitimate user-space address. The
sibling function restore_user_shstk() had the same issue and was fixed
by commit df333b72c0e1 ("riscv: cfi: Bounds check restore token before
swap").

Fixes: c70772afd5cc ("riscv/mm: Implement map_shadow_stack() syscall")
Signed-off-by: Tobias Klauser <tklauser at distanz.ch>
---
 arch/riscv/kernel/usercfi.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/arch/riscv/kernel/usercfi.c b/arch/riscv/kernel/usercfi.c
index 86141e5bab82..7971a98ca0c3 100644
--- a/arch/riscv/kernel/usercfi.c
+++ b/arch/riscv/kernel/usercfi.c
@@ -158,6 +158,9 @@ static int create_rstor_token(unsigned long ssp, unsigned long *token_addr)
 	/* On RISC-V we're constructing token to be function of address itself */
 	addr = ssp - SHSTK_ENTRY_SIZE;
 
+	if (!access_ok((unsigned long __user *)addr, SHSTK_ENTRY_SIZE))
+		return -EFAULT;
+
 	if (amo_user_shstk((unsigned long __user *)addr, (unsigned long)ssp) == -1)
 		return -EFAULT;
 
-- 
2.56.0