linux-kernel - Re: Oops with tip/x86/fpu

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:	Fri, 27 Mar 2015 20:06:29 +0100
From:	Oleg Nesterov <oleg@...hat.com>
To:	"Yu, Fenghua" <fenghua.yu@...el.com>
Cc:	Borislav Petkov <bp@...e.de>,
	"Hansen, Dave" <dave.hansen@...el.com>,
	Quentin Casasnovas <quentin.casasnovas@...cle.com>,
	Andy Lutomirski <luto@...capital.net>,
	Ingo Molnar <mingo@...nel.org>,
	Linus Torvalds <torvalds@...ux-foundation.org>,
	Pekka Riikonen <priikone@....fi>,
	Rik van Riel <riel@...hat.com>,
	Suresh Siddha <sbsiddha@...il.com>,
	LKML <linux-kernel@...r.kernel.org>
Subject: Re: Oops with tip/x86/fpu

On 03/26, Yu, Fenghua wrote:
>
> > On 03/05, Oleg Nesterov wrote:
> >
> > void sighup(int sig, siginfo_t *info, void *ctxt) {
> > 	struct ucontext *uctxt = ctxt;
> > 	struct sigcontext *sctxt = (void*)&uctxt->uc_mcontext;
> >
> > 	printf("SIGHUP! %p\n", sctxt->fpstate);
> > 	sctxt->fpstate = (void *)1;
>
> sctxt->fpstate=(void *)1 changes the fpstate pointer in the sigcontext.
> It will generate segfault and bad frame info in kernel.

Yes, but also it will trigger math_state_restore() without used_math().

This triggers 2 problems:

	1. "BUG: sleeping function called from invalid context ...".

	    Fixed by a7c80ebcac3068b1c3cb27d538d29558c30010c8

	2. On some machines this can lead to GPF. This is another FPU bug.
	   NOT FIXED yet. Because we all are busy with other problems ;)

	   And! this leads to kernel crash.

	   Fixed by 06c8173eb92bbfc03a0fe8bb64315857d0badd06

Oleg.

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/