linux-kernel - Re: [PATCH v2 6/8] x86/fpu/xstate: Update sanitize_restored

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 21 Feb 2020 15:30:10 +0100
From:   Borislav Petkov <bp@...en8.de>
To:     Yu-cheng Yu <yu-cheng.yu@...el.com>
Cc:     linux-kernel@...r.kernel.org, x86@...nel.org,
        "H. Peter Anvin" <hpa@...or.com>,
        Thomas Gleixner <tglx@...utronix.de>,
        Ingo Molnar <mingo@...hat.com>,
        Dave Hansen <dave.hansen@...ux.intel.com>,
        Tony Luck <tony.luck@...el.com>,
        Andy Lutomirski <luto@...nel.org>,
        Rik van Riel <riel@...riel.com>,
        "Ravi V. Shankar" <ravi.v.shankar@...el.com>,
        Sebastian Andrzej Siewior <bigeasy@...utronix.de>,
        Fenghua Yu <fenghua.yu@...el.com>,
        Peter Zijlstra <peterz@...radead.org>
Subject: Re: [PATCH v2 6/8] x86/fpu/xstate: Update sanitize_restored_xstate()
 for supervisor xstates

On Tue, Jan 21, 2020 at 12:18:41PM -0800, Yu-cheng Yu wrote:
> The function sanitize_restored_xstate() sanitizes user xstates of an XSAVE
> buffer by setting the buffer's header->xfeatures to the input 'xfeatures',
> effectively resetting features not in 'xfeatures' back to the init state.
> 
> When supervisor xstates are introduced, it is necessary to make sure only
> user xstates are sanitized.  This patch ensures supervisor xstates are not

Avoid having "This patch" or "This commit" in the commit message. It is
tautologically useless.

Also, do

$ git grep 'This patch' Documentation/process

for more details.

> changed by ensuring supervisor bits stay set in header->xfeatures.
> 
> To make names clear, also:
> 
> - Rename the function to sanitize_restored_user_xstate().
> - Rename input parameter 'xfeatures' to 'xfeatures_from_user'.
> - In __fpu__restore_sig(), rename 'xfeatures' to 'xfeatures_user'.

Call them all "user_xfeatures" to differentiate that it is a function
argument and not our xfeature_* macro and function names.

> Signed-off-by: Yu-cheng Yu <yu-cheng.yu@...el.com>
> Reviewed-by: Dave Hansen <dave.hansen@...ux.intel.com>
> ---
>  arch/x86/kernel/fpu/signal.c | 37 +++++++++++++++++++++++-------------
>  1 file changed, 24 insertions(+), 13 deletions(-)
> 
> diff --git a/arch/x86/kernel/fpu/signal.c b/arch/x86/kernel/fpu/signal.c
> index 4afe61987e03..e3781a4a52a8 100644
> --- a/arch/x86/kernel/fpu/signal.c
> +++ b/arch/x86/kernel/fpu/signal.c
> @@ -211,9 +211,9 @@ int copy_fpstate_to_sigframe(void __user *buf, void __user *buf_fx, int size)
>  }
>  
>  static inline void
> -sanitize_restored_xstate(union fpregs_state *state,
> -			 struct user_i387_ia32_struct *ia32_env,
> -			 u64 xfeatures, int fx_only)
> +sanitize_restored_user_xstate(union fpregs_state *state,
> +			      struct user_i387_ia32_struct *ia32_env,
> +			      u64 xfeatures_from_user, int fx_only)
>  {
>  	struct xregs_state *xsave = &state->xsave;
>  	struct xstate_header *header = &xsave->header;
> @@ -226,13 +226,22 @@ sanitize_restored_xstate(union fpregs_state *state,
>  		 */
>  
>  		/*
> -		 * Init the state that is not present in the memory
> -		 * layout and not enabled by the OS.
> +		 * 'xfeatures_from_user' might have bits clear which are
> +		 * set in header->xfeatures. This represents features that
> +		 * were in init state prior to a signal delivery, and need
> +		 * to be reset back to the init state.  Clear any user
> +		 * feature bits which are set in the kernel buffer to get
> +		 * them back to the init state.
> +		 *
> +		 * Supervisor state is unchanged by input from userspace.
> +		 * Ensure that supervisor state is not modified by ensuring
> +		 * supervisor state bits stay set.

"Ensure ... by ensuring ..." Simplify pls.

>  		 */
>  		if (fx_only)
>  			header->xfeatures = XFEATURE_MASK_FPSSE;
>  		else
> -			header->xfeatures &= xfeatures;
> +			header->xfeatures &= xfeatures_from_user |
> +					     xfeatures_mask_supervisor();
>  	}
>  
>  	if (use_fxsr()) {

-- 
Regards/Gruss,
    Boris.

https://people.kernel.org/tglx/notes-about-netiquette