CVE-2023-52761

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

riscv: VMAP_STACK overflow detection thread-safe

commit 31da94c25aea ("riscv: add VMAP_STACK overflow detection") added

support for CONFIG_VMAP_STACK. If overflow is detected, CPU switches to

`shadow_stack` temporarily before switching finally to per-cpu

`overflow_stack`.

If two CPUs/harts are racing and end up in over flowing kernel stack, one

or both will end up corrupting each other state because `shadow_stack` is

not per-cpu. This patch optimizes per-cpu overflow stack switch by

directly picking per-cpu `overflow_stack` and gets rid of `shadow_stack`.

Following are the changes in this patch

- Defines an asm macro to obtain per-cpu symbols in destination

register.

- In entry.S, when overflow is detected, per-cpu overflow stack is

located using per-cpu asm macro. Computing per-cpu symbol requires

a temporary register. x31 is saved away into CSR_SCRATCH

(CSR_SCRATCH is anyways zero since we're in ke

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References