linux-kernel - Re: [5.2 regression] copy_fpstate_to_sigframe() change causing crash in 32-bit process

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20190605173256.GA86462@gmail.com>
Date:   Wed, 5 Jun 2019 10:32:57 -0700
From:   Eric Biggers <ebiggers@...nel.org>
To:     Sebastian Andrzej Siewior <bigeasy@...utronix.de>
Cc:     Borislav Petkov <bp@...e.de>, Dave Hansen <dave.hansen@...el.com>,
        Thomas Gleixner <tglx@...utronix.de>,
        Andy Lutomirski <luto@...nel.org>,
        "H. Peter Anvin" <hpa@...or.com>, Ingo Molnar <mingo@...hat.com>,
        Jann Horn <jannh@...gle.com>,
        "Jason A. Donenfeld" <Jason@...c4.com>,
        kvm ML <kvm@...r.kernel.org>,
        Paolo Bonzini <pbonzini@...hat.com>,
        Radim Krčmář <rkrcmar@...hat.com>,
        Rik van Riel <riel@...riel.com>, x86-ml <x86@...nel.org>,
        linux-kernel@...r.kernel.org
Subject: Re: [5.2 regression] copy_fpstate_to_sigframe() change causing crash
 in 32-bit process

On Wed, Jun 05, 2019 at 04:04:05PM +0200, Sebastian Andrzej Siewior wrote:
> On 2019-06-04 11:53:58 [-0700], Eric Biggers wrote:
> > On latest Linus' tree I'm getting a crash in a 32-bit Wine process.
> > 
> > I bisected it to the following commit:
> > 
> > commit 39388e80f9b0c3788bfb6efe3054bdce0c3ead45
> > Author: Sebastian Andrzej Siewior <bigeasy@...utronix.de>
> > Date:   Wed Apr 3 18:41:35 2019 +0200
> > 
> >     x86/fpu: Don't save fxregs for ia32 frames in copy_fpstate_to_sigframe()
> > 
> > Reverting the commit by applying the following diff makes the problem go away.
> 
> This looked like a merge artifact and it has been confirmed as such. Now
> you say that this was a needed piece of code. Interesting.
> Is that wine process/testcase something you can share? I will try to
> take a closer look.
> 
> Sebastian

As I said, the commit looks broken to me.  save_fsave_header() reads from
tsk->thread.fpu.state.fxsave, which due to that commit isn't being updated with
the latest registers.  Am I missing something?  Note the comment you deleted:

	/* Update the thread's fxstate to save the fsave header. */

My test case was "run some Win32 game for a few minutes and see if it crashes"
so it's not really sharable, sorry.  But I expect it would be possible to write
a minimal test case, where a 32-bit process sends a signal to itself and checks
whether the i387 floating point stuff gets restored correctly afterwards.

- Eric