linux-kernel - Re: [PATCH RFC 2/2] x86/fpu: change xsave_user() and xrestore_user() to use __user

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Mon, 16 Mar 2015 23:43:01 +0100
From:	Quentin Casasnovas <quentin.casasnovas@...cle.com>
To:	Oleg Nesterov <oleg@...hat.com>
Cc:	Dave Hansen <dave.hansen@...el.com>, Borislav Petkov <bp@...e.de>,
	Ingo Molnar <mingo@...nel.org>,
	Andy Lutomirski <luto@...capital.net>,
	Linus Torvalds <torvalds@...ux-foundation.org>,
	Pekka Riikonen <priikone@....fi>,
	Rik van Riel <riel@...hat.com>,
	Suresh Siddha <sbsiddha@...il.com>,
	LKML <linux-kernel@...r.kernel.org>,
	"Yu, Fenghua" <fenghua.yu@...el.com>,
	Quentin Casasnovas <quentin.casasnovas@...cle.com>,
	"H. Peter Anvin" <hpa@...or.com>
Subject: Re: [PATCH RFC 2/2] x86/fpu: change xsave_user() and xrestore_user()
 to use __user_insn()

On Sun, Mar 15, 2015 at 05:50:36PM +0100, Oleg Nesterov wrote:
> Change xsave_user() and xrestore_user() to avoid the (imho) horrible
> and should-die xstate_fault helper, they both can use __user_insn().
> 
> This also removes the "memory" clobber but I think it was never needed.
> xrestore_user() doesn't change the memory, it only changes the FPU regs.
> xsave_user() does write to "*buf" but this memory is "__user", we must
> never access it directly.
> 

So I'm really not sure about all the callers, but it seems that this
instruction can be used to restore more than just the FPU state and I've no
idea how much can change underneath gcc when we do so.  It "feels" safe
when saving the CPU state, not sure for the restoring case.

> 
> This patch adds '"=m" (*buf)' in both cases, but this is only because
> currently __user_insn() needs the non-empty "output" arg.
>

See if my suggestion on your front e-mail works for you.

> 
> Note: I think we can change all other xstate_fault users too, including
> alternative_input's.
>

I'd agree but I think we'll need new safe versions of alternative_input_*()
macros as opposed to just using check_insn(alternative_input_2(...),...).
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/