[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20170923101733.kyq2avp6om2d2s3n@gmail.com>
Date: Sat, 23 Sep 2017 12:17:33 +0200
From: Ingo Molnar <mingo@...nel.org>
To: Eric Biggers <ebiggers3@...il.com>
Cc: x86@...nel.org, linux-kernel@...r.kernel.org,
kernel-hardening@...ts.openwall.com,
Andy Lutomirski <luto@...nel.org>,
Dave Hansen <dave.hansen@...ux.intel.com>,
Dmitry Vyukov <dvyukov@...gle.com>,
Fenghua Yu <fenghua.yu@...el.com>, Kevin Hao <haokexin@...il.com>,
Oleg Nesterov <oleg@...hat.com>,
Wanpeng Li <wanpeng.li@...mail.com>,
Yu-cheng Yu <yu-cheng.yu@...el.com>,
Michael Halcrow <mhalcrow@...gle.com>,
Eric Biggers <ebiggers@...gle.com>
Subject: [PATCH] x86/fpu: Simplify fpu__activate_fpstate_read()
* Eric Biggers <ebiggers3@...il.com> wrote:
> On Fri, Sep 22, 2017 at 07:33:14AM +0200, Ingo Molnar wrote:
> >
> > * Eric Biggers <ebiggers3@...il.com> wrote:
> >
> > > From: Eric Biggers <ebiggers@...gle.com>
> > >
> > > This series fixes the bug found by syzkaller where the ptrace syscall
> > > can be used to set invalid bits in a task's FPU state. I also found
> > > that an equivalent bug was reachable using the sigreturn syscall, so the
> > > first patch fixes the bug in both cases.
> > >
> > > The other two patches start validating the other parts of the
> > > xstate_header and make it so that invalid FPU states can no longer be
> > > abused to leak the FPU registers of other processes.
> > >
> > > Changes since v2:
> > > - Use an exception handler to handle invalid FPU states
> > > (suggested by Andy Lutomirski)
> > > - Check the size of xstate_header.reserved at build time
> > > (suggested by Dave Hansen)
> > >
> > > Eric Biggers (3):
> > > x86/fpu: don't let userspace set bogus xcomp_bv
> > > x86/fpu: tighten validation of user-supplied xstate_header
> > > x86/fpu: reinitialize FPU registers if restoring FPU state fails
> > >
> > > arch/x86/include/asm/fpu/internal.h | 51 +++++++++++--------------------------
> > > arch/x86/include/asm/fpu/xstate.h | 25 ++++++++++++++++++
> > > arch/x86/kernel/fpu/regset.c | 20 +++++++--------
> > > arch/x86/kernel/fpu/signal.c | 15 ++++++++---
> > > arch/x86/kernel/fpu/xstate.c | 27 ++++++++------------
> > > arch/x86/mm/extable.c | 24 +++++++++++++++++
> > > 6 files changed, 94 insertions(+), 68 deletions(-)
> >
> > Ok - could you please rebase these to to tip:master that is at:
> >
> > git git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git master
> >
> > In particular this has a WIP.x86/fpu branch with FPU fixes+changes queued up but
> > not merged upstream (yet), which conflict with these changes. I'd like to merge
> > them all together.
> >
>
> Working on it, but there is a problem with current tip. PTRACE_GETREGSET is
> causing the following warning:
Yes, the warning should be harmless, and I fixed it locally earlier today - does
the patch below solve it for you as well?
Thanks,
Ingo
============================>
Subject: x86/fpu: Simplify fpu__activate_fpstate_read()
From: Ingo Molnar <mingo@...nel.org>
Date: Sat Sep 23 11:41:23 CEST 2017
fpu__activate_fpstate_read() can only ever be called for a non-current,
non-executing (stopped) task - so make sure this is checked via a warning
and remove the current-task logic.
This also fixes an incorrect (but harmless) warning triggered by of the earlier
patches.
Cc: Andy Lutomirski <luto@...capital.net>
Cc: Borislav Petkov <bp@...en8.de>
Cc: Fenghua Yu <fenghua.yu@...el.com>
Cc: H. Peter Anvin <hpa@...or.com>
Cc: Linus Torvalds <torvalds@...ux-foundation.org>
Cc: Oleg Nesterov <oleg@...hat.com>
Cc: Peter Zijlstra <peterz@...radead.org>
Cc: Thomas Gleixner <tglx@...utronix.de>
Signed-off-by: Ingo Molnar <mingo@...nel.org>
---
arch/x86/kernel/fpu/core.c | 24 ++++++++----------------
1 file changed, 8 insertions(+), 16 deletions(-)
Index: linux/arch/x86/kernel/fpu/core.c
===================================================================
--- linux.orig/arch/x86/kernel/fpu/core.c
+++ linux/arch/x86/kernel/fpu/core.c
@@ -256,26 +256,18 @@ EXPORT_SYMBOL_GPL(fpu__activate_curr);
*
* If the task has not used the FPU before then initialize its
* fpstate.
- *
- * If the task has used the FPU before then save it.
*/
void fpu__activate_fpstate_read(struct fpu *fpu)
{
- /*
- * If fpregs are active (in the current CPU), then
- * copy them to the fpstate:
- */
- if (fpu->fpstate_active) {
- fpu__save(fpu);
- } else {
- if (!fpu->fpstate_active) {
- fpstate_init(&fpu->state);
- trace_x86_fpu_init_state(fpu);
+ WARN_ON_FPU(fpu == ¤t->thread.fpu);
+
+ if (!fpu->fpstate_active) {
+ fpstate_init(&fpu->state);
+ trace_x86_fpu_init_state(fpu);
- trace_x86_fpu_activate_state(fpu);
- /* Safe to do for current and for stopped child tasks: */
- fpu->fpstate_active = 1;
- }
+ trace_x86_fpu_activate_state(fpu);
+ /* Safe to do for current and for stopped child tasks: */
+ fpu->fpstate_active = 1;
}
}
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
