linux-kernel - [RFC][PATCH 1/2] x86, fpu: wrap get_xsave

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:	Fri, 30 Jan 2015 09:43:09 -0800
From:	Dave Hansen <dave@...1.net>
To:	oleg@...hat.com
Cc:	Dave Hansen <dave@...1.net>, dave.hansen@...ux.intel.com,
	riel@...hat.com, sbsiddha@...il.com, luto@...capital.net,
	tglx@...utronix.de, mingo@...hat.com, hpa@...or.com,
	fenghua.yu@...el.com, x86@...nel.org, linux-kernel@...r.kernel.org
Subject: [RFC][PATCH 1/2] x86, fpu: wrap get_xsave_addr() to make it safer


The MPX code appears to be saving off the FPU in an unsafe
way.   It does not disable preemption or ensure that the
FPU state has been allocated.

This patch introduces a new helper which will do both of
those things internally to a helper.

Signed-off-by: Dave Hansen <dave.hansen@...ux.intel.com>
Cc: Rik van Riel <riel@...hat.com>
Cc: Suresh Siddha <sbsiddha@...il.com>
Cc:Andy Lutomirski <luto@...capital.net>
Cc:Thomas Gleixner <tglx@...utronix.de>
Cc:Ingo Molnar <mingo@...hat.com>
Cc:"H. Peter Anvin" <hpa@...or.com>
Cc:Fenghua Yu <fenghua.yu@...el.com>
Cc:the arch/x86 maintainers <x86@...nel.org>
Cc:linux-kernel <linux-kernel@...r.kernel.org>
---

 b/arch/x86/include/asm/xsave.h |    1 +
 b/arch/x86/kernel/xsave.c      |   32 ++++++++++++++++++++++++++++++++
 2 files changed, 33 insertions(+)

diff -puN arch/x86/include/asm/xsave.h~tsk_get_xsave_addr arch/x86/include/asm/xsave.h
--- a/arch/x86/include/asm/xsave.h~tsk_get_xsave_addr	2015-01-30 09:42:15.457555582 -0800
+++ b/arch/x86/include/asm/xsave.h	2015-01-30 09:42:15.462555808 -0800
@@ -258,6 +258,7 @@ static inline int xrestore_user(struct x
 }
 
 void *get_xsave_addr(struct xsave_struct *xsave, int xstate);
+void *tsk_get_xsave_field(struct task_struct *tsk, int xstate_field);
 void setup_xstate_comp(void);
 
 #endif
diff -puN arch/x86/kernel/xsave.c~tsk_get_xsave_addr arch/x86/kernel/xsave.c
--- a/arch/x86/kernel/xsave.c~tsk_get_xsave_addr	2015-01-30 09:42:15.459555673 -0800
+++ b/arch/x86/kernel/xsave.c	2015-01-30 09:42:15.463555853 -0800
@@ -739,3 +739,35 @@ void *get_xsave_addr(struct xsave_struct
 	return (void *)xsave + xstate_comp_offsets[feature];
 }
 EXPORT_SYMBOL_GPL(get_xsave_addr);
+
+/*
+ * This wraps up the common operations that need to occur when retrieving
+ * data from an xsave struct.  It first ensures that the task was actually
+ * using the FPU and retrieves the data in to a buffer.  It then calculates
+ * the offset of the requested field in the buffer.
+ *
+ * This function is safe to call whether the FPU is in use or not.
+ *
+ * Inputs:
+ *	tsk: the task from which we are fetching xsave state
+ *	xstate: state which is defined in xsave.h (e.g. XSTATE_FP, XSTATE_SSE,
+ *	etc.)
+ * Output:
+ *	address of the state in the xsave area.
+ */
+void *tsk_get_xsave_field(struct task_struct *tsk, int xsave_field)
+{
+	union thread_xstate *xstate;
+
+	unlazy_fpu(tsk);
+	xstate = tsk->thread.fpu.state;
+	/*
+	 * This might be unallocated if the FPU
+	 * was never in use.
+	 */
+	if (!xstate)
+		return NULL;
+
+	return get_xsave_addr(&xstate->xsave, xsave_field);
+}
+EXPORT_SYMBOL_GPL(tsk_get_xsave_field);
_
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/