| Date | Sun, 20 Jun 2021 23:30:23 +0200 | From | Borislav Petkov <> | Subject | Re: [patch V3 11/66] x86/fpu: Sanitize xstateregs_set() |
| |
On Fri, Jun 18, 2021 at 04:18:34PM +0200, Thomas Gleixner wrote: > xstateregs_set() operates on a stopped task and tries to copy the provided > buffer into the task's fpu.state.xsave buffer. > > Any error while copying or invalid state detected after copying results in > wiping the target task's FPU state completely including supervisor states. > > That's just wrong. The caller supplied invalid data or has a problem with > unmapped memory, so there is absolutely no justification to corrupt the > target state. > > Fix this with the following modifications: > > 1) If data has to be copied from userspace, allocate a buffer and copy from > user first. > > 2) Use copy_kernel_to_xstate() unconditionally so that header checking > works correctly. > > 3) Return on error without corrupting the target state. > > This prevents corrupting states and lets the caller deal with the problem > it caused in the first place. > > Signed-off-by: Thomas Gleixner <tglx@linutronix.de> > --- > arch/x86/include/asm/fpu/xstate.h | 4 --- > arch/x86/kernel/fpu/regset.c | 44 +++++++++++++++----------------------- > arch/x86/kernel/fpu/xstate.c | 14 ++++++------ > 3 files changed, 26 insertions(+), 36 deletions(-)
Reviewed-by: Borislav Petkov <bp@suse.de>
Nice!
-- Regards/Gruss, Boris.
SUSE Software Solutions Germany GmbH, GF: Felix Imendörffer, HRB 36809, AG Nürnberg
|