From nobody Fri Jul 24 04:48:25 2026 Received: from mail-pf1-f181.google.com (mail-pf1-f181.google.com [209.85.210.181]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 58E0926E165 for ; Thu, 23 Jul 2026 19:48:21 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.210.181 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784836105; cv=none; b=ToHxVwZ5g+qOC8xupXXp2V7EsqEIaDhtPGUBbEOGkwTCNmtt2no4AewWrO8hOP04FwJBmW3gfIgfVmgFWSm6tkiucg1FyRlxYPwBpykdym7T3941FzIRejqk6pnR+5TOVhfUfV3scKHdAizRrbPyOY3fpjWiTd8K4dthdsriaEU= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784836105; c=relaxed/simple; bh=ufcamPUPEwCWU6mVJd+myHBwsaePxxuUitJqf+ZqRD4=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=TLPJnhVWoQV1mK63wCOWTAkMAawy7r6QASGkqt8mDi0xBEegLBmohmbTu1DujY+1OPP2cVbLQjq6ExUxtGIcySxDwUb61AoRDV8l8QjwxdSyjjiKb8liGPHvgX4eDZITCmKFoiB4ZCsBX8pm4O4H7pEXK24HsKn4BtlShtIM2eE= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=ocCUu9Fa; arc=none smtp.client-ip=209.85.210.181 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="ocCUu9Fa" Received: by mail-pf1-f181.google.com with SMTP id d2e1a72fcca58-8453427d3f4so1073905b3a.3 for ; Thu, 23 Jul 2026 12:48:21 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1784836101; x=1785440901; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=82blV+dT5OnUWyd6TkFWGn1GRoH4qwiyQgL3yxF/4aM=; b=ocCUu9Fa7vG4A/ICLTUq2EPhtx5i5vYrrxdESEkqh+QX3r495b9KJKJgmqXZPlOeKh kBrdJ+6oNHLB+YOstpkzTuzywYrtPrL2lRSv268Puk8tek0XDYO7+Eeiez+3hI+rNzbo ix5S1AFIJXv+7apDx0FwCk8JaNcOEhbpOUqQmjCL1Tt2Sw9QTZD0vm9I9pY/s8JzBFCI B4tkadvJ3rsZGClS08CcO68wOnv+1MA/mHOC7S6V0f4If2dxsOWUghG6ud5d9Un7UbjQ ffLEFrMO5lAEbhXz+PLWcV3zr79nSGFEciYnVmGD+qfUPwTd+8CgsLD8sDUal7hWimlR reTQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1784836101; x=1785440901; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=82blV+dT5OnUWyd6TkFWGn1GRoH4qwiyQgL3yxF/4aM=; b=Gg9VN/DDJY7dWfkbSM5aDyPld46oel1IXutGF2iCxRGfbHckt6X2g6S//acyosql2N BiSCFHk4Y/hrjLbMSM1ZTCTO+2JUh9NXqnOU1aPkVXqU8rFLfnhZgFLvb1/KtrlIqwA7 y3s7DXb31ACN1rAM4XV1YFnSFi+7eaV5Wgjrq7WmXNXoVzoxIGGQsYop5bJceRBh8ke2 p7zDgysdMS/X1mzLltA2ebXFeYZmKiagvoiNioqLaZM/BOygWiRhixzo3kI/LiR43L0x e5AcrY6zek6W6ONU/PwajTXBW6JwFKk+O10fOpDCmN5clv5pPHwjzW8icJHMPHA9bpjQ 1cig== X-Forwarded-Encrypted: i=1; AHgh+RoeZXQREiFS26LVDU877ya5WJIXJrvHesXfJMfr7donYmmd03YsqACSLNtFasEFurvZH8/AV0tmpywcoy8=@vger.kernel.org X-Gm-Message-State: AOJu0Yywolnzy33kGuDv4M5m8VS4Xcnxp6/tVlNLOj5CFGtPKe7Mmbdg Xz9+LjrFqeCp7QtZQcLG+7cDyMPfHMntyENAY+Y/To21iyh2T5OFUajP X-Gm-Gg: AR+sD10fd88pTvQqkRdfWTTbOpswIAqHF/ETe0Xxfjv8qZITJ3HdRkAzIGlgyKD8yU4 Dtm2kIiMZ4NEFDWx22E8KYzi9VrwduHQyMprDyKwF1wcTF5/e2SUyeNAuzHd4H+kXoZqbvSjx8z 74hpO7sTS0PIa98nY9o2K7zkQy0ktd3/guKVFdfJcHWt08Bzbni8I6umw/4qSVE4TIugO1vvnhx tqpHW2SWP+ZQsRRHO0/j6ts0DmhPKYUlr9xPMcxB0H4HZnHcn00Jst3U7yLO7kh3U9DX6e6uGT1 m23Xt1tOtgzx1IuGm0o84nnKerpV+UhMNK7d9TrbuI0ILUFsPk6F2a5PnWK9o2wVeySBaT/wd4+ fNuDnNSy0E2UbNPSOLKt1Uq83SsO0OrDRy3HguxRP8/2HljBvXxmKtGWKdQ1lVsKtQLa/KAqcXC i7VgbcnSpNyyW8G5GgBvHANcX7gQ+yLbJ8urvg4NGTzwsMSFOCAazalg== X-Received: by 2002:a05:6a21:689:b0:3c3:b57b:6455 with SMTP id adf61e73a8af0-3c44b18dd50mr4639060637.49.1784836101152; Thu, 23 Jul 2026 12:48:21 -0700 (PDT) Received: from li-1a3e774c-28e4-11b2-a85c-acc9f2883e29.ibm.com.com ([106.51.160.24]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-3149198adabsm12047139eec.8.2026.07.23.12.48.14 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 23 Jul 2026 12:48:20 -0700 (PDT) From: "Mukesh Kumar Chaurasiya (IBM)" To: oleg@redhat.com, maddy@linux.ibm.com, mpe@ellerman.id.au, npiggin@gmail.com, chleroy@kernel.org, david@kernel.org, akpm@linux-foundation.org, yeoreum.yun@arm.com, sshegde@linux.ibm.com, thuth@redhat.com, agordeev@linux.ibm.com, mchauras@linux.ibm.com, mkchauras@gmail.com, segher@kernel.crashing.org, linuxppc-dev@lists.ozlabs.org, linux-kernel@vger.kernel.org Cc: "Dmitry V. Levin" Subject: [PATCH] powerpc: Fix exit_flags field placement in pt_regs for ptrace Date: Fri, 24 Jul 2026 01:18:09 +0530 Message-ID: <20260723194809.4046600-1-mkchauras@gmail.com> X-Mailer: git-send-email 2.55.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Commit d7a6797e0bc1 ("powerpc: add exit_flags field in pt_regs") added the exit_flags field to struct pt_regs to pass internal exit control flags (e.g. _TIF_RESTOREALL) from syscall_exit_prepare() to the low-level assembly exit path. However, the field was placed in a way that was visible to userspace tools such as strace via PTRACE_GETREGS, or caused a struct layout or size regression observable through ptrace. The field is purely kernel-internal and must not be exposed beyond the user_pt_regs boundary. Move exit_flags into struct thread_info where it is only accessible to the kernel, and keep it out of the ptrace-visible register window entirely. Fixes: d7a6797e0bc1 ("powerpc: add exit_flags field in pt_regs") Reported-by: "Dmitry V. Levin" Closes: https://lore.kernel.org/all/20260722070155.GA11808@strace.io/ Signed-off-by: Mukesh Kumar Chaurasiya (IBM) --- arch/powerpc/include/asm/ptrace.h | 3 --- arch/powerpc/include/asm/thread_info.h | 1 + arch/powerpc/include/uapi/asm/ptrace.h | 14 ++++------- arch/powerpc/kernel/interrupt.c | 32 +++++++++++++++----------- arch/powerpc/kernel/ptrace/ptrace.c | 1 - arch/powerpc/kernel/signal.c | 2 +- 6 files changed, 26 insertions(+), 27 deletions(-) diff --git a/arch/powerpc/include/asm/ptrace.h b/arch/powerpc/include/asm/p= trace.h index fdeb97421785..d53c4dd4d8b6 100644 --- a/arch/powerpc/include/asm/ptrace.h +++ b/arch/powerpc/include/asm/ptrace.h @@ -53,9 +53,6 @@ struct pt_regs unsigned long esr; }; unsigned long result; - unsigned long exit_flags; - /* Maintain 16 byte interrupt stack alignment */ - unsigned long __pt_regs_pad[3]; }; }; #if defined(CONFIG_PPC64) || defined(CONFIG_PPC_KUAP) diff --git a/arch/powerpc/include/asm/thread_info.h b/arch/powerpc/include/= asm/thread_info.h index ee3b9adb5b67..0487e94d3416 100644 --- a/arch/powerpc/include/asm/thread_info.h +++ b/arch/powerpc/include/asm/thread_info.h @@ -57,6 +57,7 @@ struct thread_info { #ifdef CONFIG_SMP unsigned int cpu; #endif + unsigned long exit_flags; /* Exit Flags for entry/exit */ unsigned long syscall_work; /* SYSCALL_WORK_ flags */ unsigned long local_flags; /* private flags for thread */ #ifdef CONFIG_LIVEPATCH_64 diff --git a/arch/powerpc/include/uapi/asm/ptrace.h b/arch/powerpc/include/= uapi/asm/ptrace.h index a393b7f2760a..01e630149d48 100644 --- a/arch/powerpc/include/uapi/asm/ptrace.h +++ b/arch/powerpc/include/uapi/asm/ptrace.h @@ -55,8 +55,6 @@ struct pt_regs unsigned long dar; /* Fault registers */ unsigned long dsisr; /* on 4xx/Book-E used for ESR */ unsigned long result; /* Result of a system call */ - unsigned long exit_flags; /* System call exit flags */ - unsigned long __pt_regs_pad[3]; /* Maintain 16 byte interrupt stack align= ment */ }; =20 #endif /* __ASSEMBLER__ */ @@ -116,12 +114,10 @@ struct pt_regs #define PT_DAR 41 #define PT_DSISR 42 #define PT_RESULT 43 -#define PT_EXIT_FLAGS 44 -#define PT_PAD 47 /* 3 times */ -#define PT_DSCR 48 -#define PT_REGS_COUNT 48 +#define PT_DSCR 44 +#define PT_REGS_COUNT 44 =20 -#define PT_FPR0 (PT_REGS_COUNT + 4) /* each FP reg occupies 2 slots in thi= s space */ +#define PT_FPR0 48 /* each FP reg occupies 2 slots in this space */ =20 #ifndef __powerpc64__ =20 @@ -133,7 +129,7 @@ struct pt_regs #define PT_FPSCR (PT_FPR0 + 32) /* each FP reg occupies 1 slot in 64-bit s= pace */ =20 =20 -#define PT_VR0 (PT_FPSCR + 2) /* <82> each Vector reg occupies 2 slots in = 64-bit */ +#define PT_VR0 82 /* each Vector reg occupies 2 slots in 64-bit */ #define PT_VSCR (PT_VR0 + 32*2 + 1) #define PT_VRSAVE (PT_VR0 + 33*2) =20 @@ -141,7 +137,7 @@ struct pt_regs /* * Only store first 32 VSRs here. The second 32 VSRs in VR0-31 */ -#define PT_VSR0 (PT_VRSAVE + 2) /* each VSR reg occupies 2 slots in 64-bit= */ +#define PT_VSR0 150 /* each VSR reg occupies 2 slots in 64-bit */ #define PT_VSR31 (PT_VSR0 + 2*31) #endif /* __powerpc64__ */ =20 diff --git a/arch/powerpc/kernel/interrupt.c b/arch/powerpc/kernel/interrup= t.c index f04978080837..5b88bf72786c 100644 --- a/arch/powerpc/kernel/interrupt.c +++ b/arch/powerpc/kernel/interrupt.c @@ -89,15 +89,17 @@ notrace unsigned long syscall_exit_prepare(unsigned lon= g r3, long scv) { unsigned long ti_flags; + unsigned long ret =3D 0; bool is_not_scv =3D !IS_ENABLED(CONFIG_PPC_BOOK3S_64) || !scv; =20 kuap_assert_locked(); =20 regs->result =3D r3; - regs->exit_flags =3D 0; =20 - ti_flags =3D read_thread_flags(); + /* Clear exit_flags so only flags set during this exit are visible */ + current->thread_info.exit_flags =3D 0; =20 + ti_flags =3D read_thread_flags(); if (unlikely(r3 >=3D (unsigned long)-MAX_ERRNO) && is_not_scv) { if (likely(!(ti_flags & (_TIF_NOERROR | _TIF_RESTOREALL)))) { r3 =3D -r3; @@ -107,7 +109,7 @@ notrace unsigned long syscall_exit_prepare(unsigned lon= g r3, =20 if (unlikely(ti_flags & _TIF_PERSYSCALL_MASK)) { if (ti_flags & _TIF_RESTOREALL) - regs->exit_flags =3D _TIF_RESTOREALL; + ret =3D _TIF_RESTOREALL; else regs->gpr[3] =3D r3; clear_bits(_TIF_PERSYSCALL_MASK, ¤t_thread_info()->flags); @@ -116,7 +118,7 @@ notrace unsigned long syscall_exit_prepare(unsigned lon= g r3, } =20 if (unlikely(ti_flags & _TIF_SYSCALL_DOTRACE)) { - regs->exit_flags |=3D _TIF_RESTOREALL; + ret |=3D _TIF_RESTOREALL; } =20 syscall_exit_to_user_mode(regs); @@ -132,17 +134,19 @@ notrace unsigned long syscall_exit_prepare(unsigned l= ong r3, =20 /* Restore user access locks last */ kuap_user_restore(regs); - + ret |=3D current->thread_info.exit_flags; #ifdef CONFIG_PPC64 - regs->exit_result =3D regs->exit_flags; + regs->exit_result =3D ret; #endif =20 - return regs->exit_flags; + return ret; } =20 #ifdef CONFIG_PPC64 notrace unsigned long syscall_exit_restart(unsigned long r3, struct pt_reg= s *regs) { + unsigned long ret; + /* * This is called when detecting a soft-pending interrupt as well as * an alternate-return interrupt. So we can't just have the alternate @@ -167,9 +171,11 @@ notrace unsigned long syscall_exit_restart(unsigned lo= ng r3, struct pt_regs *reg } =20 kuap_user_restore(regs); - regs->exit_result |=3D regs->exit_flags; + ret =3D current_thread_info()->exit_flags & _TIF_RESTOREALL; + current_thread_info()->exit_flags &=3D ~_TIF_RESTOREALL; + regs->exit_result |=3D ret; =20 - return regs->exit_result; + return ret; } #endif =20 @@ -186,8 +192,10 @@ notrace unsigned long interrupt_exit_user_prepare(stru= ct pt_regs *regs) */ kuap_assert_locked(); =20 + /* Clear exit_flags so only flags set during this exit are visible */ + current_thread_info()->exit_flags =3D 0; + local_irq_disable(); - regs->exit_flags =3D 0; again: check_return_regs_valid(regs); user_enter_irqoff(); @@ -200,9 +208,7 @@ notrace unsigned long interrupt_exit_user_prepare(struc= t pt_regs *regs) =20 /* Restore user access locks last */ kuap_user_restore(regs); - - ret =3D regs->exit_flags; - + ret =3D current_thread_info()->exit_flags & _TIF_RESTOREALL; #ifdef CONFIG_PPC64 regs->exit_result =3D ret; #endif diff --git a/arch/powerpc/kernel/ptrace/ptrace.c b/arch/powerpc/kernel/ptra= ce/ptrace.c index 316d4f5ead8e..6cd180bc36ab 100644 --- a/arch/powerpc/kernel/ptrace/ptrace.c +++ b/arch/powerpc/kernel/ptrace/ptrace.c @@ -291,7 +291,6 @@ void __init pt_regs_check(void) CHECK_REG(PT_DAR, dar); CHECK_REG(PT_DSISR, dsisr); CHECK_REG(PT_RESULT, result); - CHECK_REG(PT_EXIT_FLAGS, exit_flags); #undef CHECK_REG =20 BUILD_BUG_ON(PT_REGS_COUNT !=3D sizeof(struct user_pt_regs) / sizeof(unsi= gned long)); diff --git a/arch/powerpc/kernel/signal.c b/arch/powerpc/kernel/signal.c index bb42a8b6c642..cc6498501610 100644 --- a/arch/powerpc/kernel/signal.c +++ b/arch/powerpc/kernel/signal.c @@ -356,6 +356,6 @@ void signal_fault(struct task_struct *tsk, struct pt_re= gs *regs, void arch_do_signal_or_restart(struct pt_regs *regs) { BUG_ON(regs !=3D current->thread.regs); - regs->exit_flags |=3D _TIF_RESTOREALL; + current_thread_info()->exit_flags |=3D _TIF_RESTOREALL; do_signal(current); } --=20 2.55.0