arch_ptrace() accepts PTRACE_POKEUSR for every aligned offset below
PT_SIZE. This includes the saved machine status register and pt_mode,
which are kernel-owned execution state rather than general registers.

On return from an exception, rtbd copies MSR_UMS to the live MSR_UM bit.
An unprivileged same-UID tracer can therefore clear MSR_UMS in its
tracee's saved register frame and make the tracee resume in supervisor
mode. pt_mode also controls whether later entry paths classify the frame
as kernel or user state.

Reject PTRACE_POKEUSR writes to both fields while retaining read access.

Fixes: 2b4384542691 ("microblaze_v8: ptrace support")
Assisted-by: Codex:gpt-5
Signed-off-by: Jérémy Jean <Jeremy.Jean@oss.cyber.gouv.fr>
---
 arch/microblaze/kernel/ptrace.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/arch/microblaze/kernel/ptrace.c b/arch/microblaze/kernel/ptrace.c
index 236264e932d6..ac1f0503216b 100644
--- a/arch/microblaze/kernel/ptrace.c
+++ b/arch/microblaze/kernel/ptrace.c
@@ -101,6 +101,9 @@ long arch_ptrace(struct task_struct *child, long request,
 			} else {
 				rval = -EIO;
 			}
+		} else if (request == PTRACE_POKEUSR &&
+			   (addr == PT_MSR || addr == PT_MODE)) {
+			rval = -EIO;
 		} else if (addr < PT_SIZE && (addr & 0x3) == 0) {
 			microblaze_reg_t *reg_addr = reg_save_addr(addr, child);
 			if (request == PTRACE_PEEKUSR)
-- 
2.47.3

On 8/21/26 12:30, Jérémy Jean wrote:
> arch_ptrace() accepts PTRACE_POKEUSR for every aligned offset below
> PT_SIZE. This includes the saved machine status register and pt_mode,
> which are kernel-owned execution state rather than general registers.
> 
> On return from an exception, rtbd copies MSR_UMS to the live MSR_UM bit.
> An unprivileged same-UID tracer can therefore clear MSR_UMS in its
> tracee's saved register frame and make the tracee resume in supervisor
> mode. pt_mode also controls whether later entry paths classify the frame
> as kernel or user state.
> 
> Reject PTRACE_POKEUSR writes to both fields while retaining read access.
> 
> Fixes: 2b4384542691 ("microblaze_v8: ptrace support")
> Assisted-by: Codex:gpt-5
> Signed-off-by: Jérémy Jean <Jeremy.Jean@oss.cyber.gouv.fr>
> ---
>   arch/microblaze/kernel/ptrace.c | 3 +++
>   1 file changed, 3 insertions(+)
> 
> diff --git a/arch/microblaze/kernel/ptrace.c b/arch/microblaze/kernel/ptrace.c
> index 236264e932d6..ac1f0503216b 100644
> --- a/arch/microblaze/kernel/ptrace.c
> +++ b/arch/microblaze/kernel/ptrace.c
> @@ -101,6 +101,9 @@ long arch_ptrace(struct task_struct *child, long request,
>   			} else {
>   				rval = -EIO;
>   			}
> +		} else if (request == PTRACE_POKEUSR &&
> +			   (addr == PT_MSR || addr == PT_MODE)) {
> +			rval = -EIO;
>   		} else if (addr < PT_SIZE && (addr & 0x3) == 0) {
>   			microblaze_reg_t *reg_addr = reg_save_addr(addr, child);
>   			if (request == PTRACE_PEEKUSR)


Applied.
M

-- 
Michal Simek, Ing. (M.Eng), OpenPGP -> KeyID: FE3D1F91
w: www.monstr.eu p: +42-0-721842854
Maintainer of Linux kernel - Xilinx Microblaze
Maintainer of Linux kernel - Xilinx Zynq ARM and ZynqMP/Versal ARM64 SoCs
U-Boot custodian - Xilinx Microblaze/Zynq/ZynqMP/Versal/Versal NET SoCs
TF-A maintainer - Xilinx ZynqMP/Versal/Versal NET SoCs