linux-kernel - RE: [PATCH Bugfix v2 2/4] x86/xsaves: Define and use user_xstate

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Thu, 23 Apr 2015 17:09:27 +0000
From:	"Yu, Fenghua" <fenghua.yu@...el.com>
To:	"Hansen, Dave" <dave.hansen@...el.com>,
	"H. Peter Anvin" <hpa@...ux.intel.com>,
	Ingo Molnar <mingo@...e.hu>,
	Thomas Gleixner <tglx@...utronix.de>,
	"Mallick, Asit K" <asit.k.mallick@...el.com>,
	"Williamson, Glenn P" <glenn.p.williamson@...el.com>
CC:	linux-kernel <linux-kernel@...r.kernel.org>, x86 <x86@...nel.org>
Subject: RE: [PATCH Bugfix v2 2/4] x86/xsaves: Define and use
 user_xstate_size for xstate size in signal context

> From: Hansen, Dave
> Sent: Wednesday, April 22, 2015 5:35 PM
> On 04/22/2015 05:06 PM, Yu, Fenghua wrote:
> > We need to copy ALL of supported xstates to user. Using xstate_bv only
> > copies partial xstates that are in non-init status.
> >
> > Xstate_bv only has xstates that are in non-init status. The xstates
> > that are in init status will not be copied to user if using xstate_bv.
> > In this case, the xstates that are in init status will be all zeros in
> > the user buffer (remember we clear the user buffer before). That's
> incorrect.
> I'm not convinced.  Let's step through this.
> 
> 1. kernel does an xsaves
> 2. Due to the 'init optimization' xstate_bv != pcntxt_mask, and some
>    fields of kernel xsave buffer are untouched 3. Kernel looks at pcntxt_mask,
> which means it copies untouched xsave
>    buffer fields out to userspace
> 
> If those untouched fields of the xsave buffer are in the "init state", then
> we've got no problem.  But, are those "untouched since (1)" fields in the
> kernel xsave buf *GUARANTEED* to be in the init state?

In fact, those untouched fields in kernel xsave buf "IS GUARANTEED" to be in
the init state.

Please check __sanitize_i387_state() called just before copy_to_user_xstate().
That functions GUARANTEES the untouched fields in kernel xsave buf to be in
init state.

Thanks.

-Fenghua