Summary
When the Global Pointer (GP) relative addressing is enabled (CONFIG_RISCV_GP=y), the gp reg points at 0x800 bytes past the start of the .sdata section which is then used by the linker to relax accesses to global symbols.
|
#ifdef CONFIG_RISCV_GP |
|
/* |
|
* RISC-V architecture has 12-bit signed immediate offsets in the |
|
* instructions. If we can put the most commonly accessed globals |
|
* in a special 4K span of memory addressed by the GP register, then |
|
* we can access those values in a single instruction, saving both |
|
* codespace and runtime. |
|
* |
|
* Since these immediate offsets are signed, place gp 0x800 past the |
|
* beginning of .sdata so that we can use both positive and negative |
|
* offsets. |
|
*/ |
|
. = ALIGN(8); |
|
PROVIDE (__global_pointer$ = . + 0x800); |
|
#endif |
However, the gp reg is not protected against write from userspace, this means that a rogue userspace can corrupt the gp reg, and cause the compiled instruction to access random addresses.
Expected behavior
The gp register should remain a constant.
Environment (please complete the following information):
- Toolchain (e.g Zephyr SDK, ...): 0.16.8
- Commit SHA or Version used: v3.7 branch
Impact
A rogue thread can corrupt the gp reg and cause the entire system to hard fault at best, at worst, it can potentially trick the system to access another set of random global symbols.
Patches
main: #81155
v3.7: #81370
For more information
If you have any questions or comments about this advisory:
ycsin Reporter
Summary
When the Global Pointer (GP) relative addressing is enabled (
CONFIG_RISCV_GP=y), thegpreg points at 0x800 bytes past the start of the.sdatasection which is then used by the linker to relax accesses to global symbols.zephyr/include/zephyr/arch/riscv/common/linker.ld
Lines 305 to 319 in c0a0e6a
However, the
gpreg is not protected against write from userspace, this means that a rogue userspace can corrupt thegpreg, and cause the compiled instruction to access random addresses.Expected behavior
The
gpregister should remain a constant.Environment (please complete the following information):
Impact
A rogue thread can corrupt the
gpreg and cause the entire system to hard fault at best, at worst, it can potentially trick the system to access another set of random global symbols.Patches
main: #81155
v3.7: #81370
For more information
If you have any questions or comments about this advisory: