lkml.org 
[lkml]   [2021]   [Jun]   [20]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [patch V3 11/66] x86/fpu: Sanitize xstateregs_set()
On Fri, Jun 18, 2021 at 04:18:34PM +0200, Thomas Gleixner wrote:
> xstateregs_set() operates on a stopped task and tries to copy the provided
> buffer into the task's fpu.state.xsave buffer.
>
> Any error while copying or invalid state detected after copying results in
> wiping the target task's FPU state completely including supervisor states.
>
> That's just wrong. The caller supplied invalid data or has a problem with
> unmapped memory, so there is absolutely no justification to corrupt the
> target state.
>
> Fix this with the following modifications:
>
> 1) If data has to be copied from userspace, allocate a buffer and copy from
> user first.
>
> 2) Use copy_kernel_to_xstate() unconditionally so that header checking
> works correctly.
>
> 3) Return on error without corrupting the target state.
>
> This prevents corrupting states and lets the caller deal with the problem
> it caused in the first place.
>
> Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
> ---
> arch/x86/include/asm/fpu/xstate.h | 4 ---
> arch/x86/kernel/fpu/regset.c | 44 +++++++++++++++-----------------------
> arch/x86/kernel/fpu/xstate.c | 14 ++++++------
> 3 files changed, 26 insertions(+), 36 deletions(-)

Reviewed-by: Borislav Petkov <bp@suse.de>

Nice!

--
Regards/Gruss,
Boris.

SUSE Software Solutions Germany GmbH, GF: Felix Imendörffer, HRB 36809, AG Nürnberg

\
 
 \ /
  Last update: 2021-06-20 23:31    [W:0.622 / U:0.388 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site