linux-kernel - [PATCH v4 0/3] x86/fpu: prevent leaking FPU registers via invalid FPU state

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20170922174156.16780-1-ebiggers3@gmail.com>
Date:   Fri, 22 Sep 2017 10:41:53 -0700
From:   Eric Biggers <ebiggers3@...il.com>
To:     x86@...nel.org
Cc:     linux-kernel@...r.kernel.org, kernel-hardening@...ts.openwall.com,
        Andy Lutomirski <luto@...nel.org>,
        Dave Hansen <dave.hansen@...ux.intel.com>,
        Dmitry Vyukov <dvyukov@...gle.com>,
        Fenghua Yu <fenghua.yu@...el.com>,
        Ingo Molnar <mingo@...nel.org>, Kevin Hao <haokexin@...il.com>,
        Oleg Nesterov <oleg@...hat.com>,
        Wanpeng Li <wanpeng.li@...mail.com>,
        Yu-cheng Yu <yu-cheng.yu@...el.com>,
        Michael Halcrow <mhalcrow@...gle.com>,
        Eric Biggers <ebiggers@...gle.com>
Subject: [PATCH v4 0/3] x86/fpu: prevent leaking FPU registers via invalid FPU state

From: Eric Biggers <ebiggers@...gle.com>

This series fixes the bug found by syzkaller where the ptrace syscall
can be used to set invalid bits in a task's FPU state.  I also found
that an equivalent bug was reachable using the sigreturn syscall, so the
first patch fixes the bug in both cases.

The other two patches start validating the other parts of the
xstate_header and make it so that invalid FPU states can no longer be
abused to leak the FPU registers of other processes.

Changes since v3:
    - Rebase onto tip/master

Changes since v2:
    - Use an exception handler to handle invalid FPU states
      (suggested by Andy Lutomirski)
    - Check the size of xstate_header.reserved at build time
      (suggested by Dave Hansen)

Eric Biggers (3):
  x86/fpu: don't let userspace set bogus xcomp_bv
  x86/fpu: tighten validation of user-supplied xstate_header
  x86/fpu: reinitialize FPU registers if restoring FPU state fails

 arch/x86/include/asm/fpu/internal.h | 51 +++++++++++-------------------------
 arch/x86/include/asm/fpu/xstate.h   | 25 ++++++++++++++++++
 arch/x86/kernel/fpu/regset.c        | 17 +++++-------
 arch/x86/kernel/fpu/signal.c        | 18 ++++++++-----
 arch/x86/kernel/fpu/xstate.c        | 52 ++++++++++++++-----------------------
 arch/x86/mm/extable.c               | 24 +++++++++++++++++
 6 files changed, 102 insertions(+), 85 deletions(-)

-- 
2.14.1.821.g8fa685d3b7-goog