linux-kernel - [tip:x86/urgent] x86/fpu: Disable bottom halves while loading FPU registers

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <tip-265fb8fe4c69a94431a17e8b87a9613d30fefe79@git.kernel.org>
Date:   Tue, 20 Nov 2018 04:05:14 -0800
From:   tip-bot for Sebastian Andrzej Siewior <tipbot@...or.com>
To:     linux-tip-commits@...r.kernel.org
Cc:     x86@...nel.org, luto@...nel.org, mingo@...nel.org, hpa@...or.com,
        tglx@...utronix.de, bp@...e.de, Jason@...c4.com,
        dave.hansen@...ux.intel.com, riel@...riel.com,
        linux-kernel@...r.kernel.org, kvm@...r.kernel.org,
        pbonzini@...hat.com, rkrcmar@...hat.com, bigeasy@...utronix.de
Subject: [tip:x86/urgent] x86/fpu: Disable bottom halves while loading FPU
 registers

Commit-ID:  265fb8fe4c69a94431a17e8b87a9613d30fefe79
Gitweb:     https://git.kernel.org/tip/265fb8fe4c69a94431a17e8b87a9613d30fefe79
Author:     Sebastian Andrzej Siewior <bigeasy@...utronix.de>
AuthorDate: Tue, 20 Nov 2018 11:26:35 +0100
Committer:  Borislav Petkov <bp@...e.de>
CommitDate: Tue, 20 Nov 2018 13:01:32 +0100

x86/fpu: Disable bottom halves while loading FPU registers

The sequence

  fpu->initialized = 1;		/* step A */
  preempt_disable();		/* step B */
  fpu__restore(fpu);
  preempt_enable();

in __fpu__restore_sig() is racy in regard to a context switch.

For 32bit frames, __fpu__restore_sig() prepares the FPU state within
fpu->state. To ensure that a context switch (switch_fpu_prepare() in
particular) does not modify fpu->state it uses fpu__drop() which sets
fpu->initialized to 0.

After fpu->initialized is cleared, the CPU's FPU state is not saved
to fpu->state during a context switch. The new state is loaded via
fpu__restore(). It gets loaded into fpu->state from userland and
ensured it is sane. fpu->initialized is then set to 1 in order to avoid
fpu__initialize() doing anything (overwrite the new state) which is part
of fpu__restore().

A context switch between step A and B above would save CPU's current FPU
registers to fpu->state and overwrite the newly prepared state. This
looks like a tiny race window but the Kernel Test Robot reported this
back in 2016 while we had lazy FPU support. Borislav Petkov made the
link between that report and another patch that has been posted. Since
the removal of the lazy FPU support, this race goes unnoticed because
the warning has been removed.

Disable bottom halves around the restore sequence to avoid the race. BH
need to be disabled because BH is allowed to run (even with preemption
disabled) and might invoke kernel_fpu_begin() by doing IPsec.

 [ bp: massage commit message a bit. ]

Signed-off-by: Sebastian Andrzej Siewior <bigeasy@...utronix.de>
Signed-off-by: Borislav Petkov <bp@...e.de>
Acked-by: Ingo Molnar <mingo@...nel.org>
Acked-by: Thomas Gleixner <tglx@...utronix.de>
CC: Andy Lutomirski <luto@...nel.org>
CC: Dave Hansen <dave.hansen@...ux.intel.com>
CC: "H. Peter Anvin" <hpa@...or.com>
CC: "Jason A. Donenfeld" <Jason@...c4.com>
CC: kvm ML <kvm@...r.kernel.org>
CC: Paolo Bonzini <pbonzini@...hat.com>
CC: Radim Krčmář <rkrcmar@...hat.com>
CC: Rik van Riel <riel@...riel.com>
Cc: stable@...r.kernel.org
CC: x86-ml <x86@...nel.org>
Link: http://lkml.kernel.org/r/20181120102635.ddv3fvavxajjlfqk@linutronix.de
Link: https://lkml.kernel.org/r/20160226074940.GA28911@pd.tnic
---
 arch/x86/kernel/fpu/signal.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/arch/x86/kernel/fpu/signal.c b/arch/x86/kernel/fpu/signal.c
index 61a949d84dfa..d99a8ee9e185 100644
--- a/arch/x86/kernel/fpu/signal.c
+++ b/arch/x86/kernel/fpu/signal.c
@@ -344,10 +344,10 @@ static int __fpu__restore_sig(void __user *buf, void __user *buf_fx, int size)
 			sanitize_restored_xstate(tsk, &env, xfeatures, fx_only);
 		}

+		local_bh_disable();
 		fpu->initialized = 1;
-		preempt_disable();
 		fpu__restore(fpu);
-		preempt_enable();
+		local_bh_enable();

 		return err;
 	} else {