[PATCH 1/2] arm64/fpsimd: ptrace: Fix inactive SVE and SSVE regsets

[Karl Mehltretter <kmehltretter@gmail.com>]

sve_init_header_from_task() takes header as a pointer, so for the
inactive mode

	header->size = sizeof(header);

stores 8 rather than sizeof(struct user_sve_header), which is 16.
Userspace sees an impossible size smaller than the header it
describes.

The inactive-mode check in sve_get_common() compares header.size
against sizeof(header) as well, but there header is a struct, so the
check can never fire. Reads of NT_ARM_SVE and NT_ARM_SSVE for the
inactive mode therefore still return the other mode's FPSIMD data,
exactly the situation the check was added to prevent.

Fix the size, and make the check return the remaining membuf space
instead of 0, which regset_get() would interpret as the entire
(zero-filled) buffer having been populated.

Fixes: b93e685ecff7 ("arm64/fpsimd: ptrace: Do not present register data for inactive mode")
Assisted-by: Claude:claude-opus-5
Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com>
---
Found by inspection while reviewing arch/arm64.

Confirmed in the generated code: building arch/arm64/kernel/ptrace.o
with arm64 defconfig and gcc 15.2.0 and disassembling sve_get_common
shows the inactive branch storing a literal 8 into header.size, and no
compare against 16 anywhere - the compiler constant-folds the check
away entirely and falls straight through to __fpr_get(). That is a
machine-checked demonstration that the early return can never fire.

Runtime tested under QEMU TCG with -cpu max,sme=on. Before this
change, PTRACE_GETREGSET(NT_ARM_SSVE) on a tracee outside streaming
mode returned header.size == 8 and copied the 528-byte NT_PRFPREG
payload. Afterwards, header.size is 16 and bytes in the userspace
buffer after the header are left untouched.

 arch/arm64/kernel/ptrace.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/arch/arm64/kernel/ptrace.c b/arch/arm64/kernel/ptrace.c
index 4d08598e2891..2a72c61a8af9 100644
--- a/arch/arm64/kernel/ptrace.c
+++ b/arch/arm64/kernel/ptrace.c
@@ -801,7 +801,7 @@ static void sve_init_header_from_task(struct user_sve_header *header,
 	if (active)
 		header->size = SVE_PT_SIZE(vq, header->flags);
 	else
-		header->size = sizeof(header);
+		header->size = sizeof(*header);
 	header->max_size = SVE_PT_SIZE(sve_vq_from_vl(header->max_vl),
 				      SVE_PT_REGS_SVE);
 }
@@ -837,7 +837,7 @@ static int sve_get_common(struct task_struct *target,
 	 * from the other mode to userspace.
 	 */
 	if (header.size == sizeof(header))
-		return 0;
+		return to.left;
 
 	switch ((header.flags & SVE_PT_REGS_MASK)) {
 	case SVE_PT_REGS_FPSIMD:
-- 
2.51.0