linux-kernel - Re: [syzbot] WARNING in ex_handler

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <871r9s7zrl.ffs@nanos.tec.linutronix.de>
Date:   Thu, 27 May 2021 21:17:02 +0200
From:   Thomas Gleixner <tglx@...utronix.de>
To:     "Yu\, Yu-cheng" <yu-cheng.yu@...el.com>,
        Andy Lutomirski <luto@...nel.org>,
        syzbot <syzbot+2067e764dbcd10721e2e@...kaller.appspotmail.com>,
        bp@...en8.de, bp@...e.de, dave.hansen@...ux.intel.com,
        fenghua.yu@...el.com, hpa@...or.com, linux-kernel@...r.kernel.org,
        mingo@...hat.com, peterz@...radead.org,
        syzkaller-bugs@...glegroups.com, tony.luck@...el.com,
        x86@...nel.org
Subject: Re: [syzbot] WARNING in ex_handler_fprestore

On Thu, May 27 2021 at 11:59, Yu-cheng Yu wrote:
> On 5/27/2021 9:49 AM, Thomas Gleixner wrote:
>> On Thu, May 27 2021 at 00:03, Thomas Gleixner wrote:
>>> I decoded it fully by now and will send out coherent info (and hopefully
>>> a patch) tomorrow with brain awake. Time for bed here...
>> 
>> Not yet there with a patch, but I have a trivial C reproducer. See
>> below.
>> 
>> The failure mode is:
>> 
>>      signal to task
>>        sigaction_handler()
>>          wreckage xsave.header.reserved[0]
>>          sig_return()
>>            restore_fpu_from_sigframe()
>>              try: XRSTOR from user -> #GP
>>              copy_from_user(fpstate, task->fpu.state.xsave);
>>              validate(task->fpu.state.xsave) -> fail
>>              fpu__clear_user_states()
>>                reinits FPU hardware but task state is still wreckaged
>
> In fpu__clear_user_states(), maybe can we clear xstate_header.reserved[] 
> as well?

Just because my reproducer wreckages xstate_header.reserved, you think
it's sufficient to maybe clear that field? May I recommend to study the
XSAVE documentation?

> Or do we want to check the user buffer first before copy it?

Before your patch the code was correct. So maybe study the SDM, the code
and the commit and carefully read this email plus the following ones
before you come up with more helpful suggestions.

<SNIP>
     80 lines of useless quotes
</SNIP>

See: https://people.kernel.org/tglx/notes-about-netiquette

Thanks,

        tglx