Skip to content
Commit 2abf7ce2 authored by Daniel Leung's avatar Daniel Leung Committed by Benjamin Cabé
Browse files

xtensa: userspace: prevent potential privilege escalation



When context switching and dealing with non-nested interrupts,
the context to be restored are saved in the thread stack.
When userspace is enabled, this means saving context into
the user stacks for user threads. This allows PS values to be
manipulated externally by setting PS.RING in the saved PS
value to 0, resulting in granting kernel access privilege when
the thread is restored. To prevent this, we store the PS value
into the thread struct instead, where user threads cannot
manipulate that. Note that nested interrupts and syscalls are
not using the user stack but the interrupt stack and thread
privileged stack respectively, where they are not accessible
under user mode.

Signed-off-by: default avatarDaniel Leung <daniel.leung@intel.com>
parent d5c2e4b0
Loading
Loading
Loading
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please to comment