linux-kernel - Re: [patch 0/8] x86/fpu: Mop up XSAVES and related damage

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date:   Fri, 4 Jun 2021 15:04:41 -0700
From:   Dave Hansen <dave.hansen@...el.com>
To:     Thomas Gleixner <tglx@...utronix.de>,
        LKML <linux-kernel@...r.kernel.org>
Cc:     x86@...nel.org, Andy Lutomirski <luto@...nel.org>,
        Dave Hansen <dave.hansen@...ux.intel.com>,
        Fenghua Yu <fenghua.yu@...el.com>,
        Tony Luck <tony.luck@...el.com>,
        Yu-cheng Yu <yu-cheng.yu@...el.com>
Subject: Re: [patch 0/8] x86/fpu: Mop up XSAVES and related damage

The nice Intel 0day folks threw some tests at this series.  It managed
to trigger an oops.  I can't right this moment publish the source for
the test, but it looks pretty trivial.  It basically creates a 0'd XSAVE
buffer, sets XCOMP_BV to:

#define XSAVES_FEATURES ( \
        XFEATURE_MASK_PT | \
        XFEATURE_MASK_SHSTK_USER | \
        XFEATURE_MASK_SHSTK_KERNEL | \
        0x8000000000000000 \
        )

Then passes that buffer in to ptrace(PTRACE_SETREGSET, ...).

The oops is below.  It doesn't *look* to be XSAVES-related.  The oops
looks like it's happening in xstateregs_set() itself as opposed to down
in the code actually concerned with supervisor state.

No bug is jumping out of the code as I took a brief look at it.  The
xbuf versus kbuf code looks a bit wonky, but I can't find a hole in it.

I'll see if I can reproduce this locally.

> [   38.612897] BAT XSAVE
> [   38.612902]
> [   38.619525] os
> [   38.619528]
> [   38.625885] enumeration
> [   38.625890]
> [   38.633098] schedule check
> [   38.633105]
> [   38.640308] fork check
> [   38.640321]
> [   38.647154] signal check
> [   38.647164]
> [   38.654065] thread check
> [   38.654072]
> [   38.661036] multi thread check
> [   38.661042]
> [   75.771095] BUG: kernel NULL pointer dereference, address: 0000000000000000
> [   75.779596] #PF: supervisor read access in kernel mode
> [   75.785980] #PF: error_code(0x0000) - not-present page
> [   75.792321] PGD 0 P4D 0
> [   75.795742] Oops: 0000 [#1] SMP PTI
> [   75.800233] CPU: 94 PID: 2145 Comm: ptrace_sys_stat Not tainted 5.13.0-rc4-00096-g2c38e60b245f #1
> [   75.810753] Hardware name: Intel Corporation BRICKLAND/BRICKLAND, BIOS BRHSXSD1.86B.0067.R02.1507221722 07/22/2015
> [   75.822934] RIP: 0010:xstateregs_set+0x9f/0x140
> [   75.828591] Code: e0 5d 41 5c 41 5d 41 5e 41 5f c3 41 89 cf 4d 89 ce 4c 89 ff e8 32 87 2e 00 48 89 c5 48 85 c0 0f 84 8a 00 00 00 45 85 e4 74 20 <48> 8b 34 25 00 00 00 00 48 85 f6 74 2f 4c 89 fa 48 89 c7 e8 89 78
> [   75.850813] RSP: 0018:ffffc90023a47e38 EFLAGS: 00010202
> [   75.857241] RAX: ffffc9000c9dd000 RBX: ffff88c107824f80 RCX: 8000000000000063
> [   75.865827] RDX: 0000000000000001 RSI: ffff888100000000 RDI: ffff888100203328
> [   75.874376] RBP: ffffc9000c9dd000 R08: ffff88810cdffef0 R09: 8000000000000063
> [   75.882928] R10: 0000000000000ee8 R11: ffff88a08159c3f0 R12: 0000000000000340
> [   75.891427] R13: ffff88c1078273c0 R14: 000055576f8960c0 R15: 0000000000000340
> [   75.899961] FS:  00007f50ad027500(0000) GS:ffff88bfff980000(0000) knlGS:0000000000000000
> [   75.909533] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> [   75.916458] CR2: 0000000000000000 CR3: 000000208df04004 CR4: 00000000001706e0
> [   75.924975] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
> [   75.933434] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
> [   75.941911] Call Trace:
> [   75.945118]  ptrace_request+0x4cb/0x600
> [   75.949893]  arch_ptrace+0x125/0x300
> [   75.954350]  ? ptrace_check_attach+0x69/0x140
> [   75.959690]  __x64_sys_ptrace+0x80/0x140
> [   75.964532]  do_syscall_64+0x40/0x80
> [   75.969004]  entry_SYSCALL_64_after_hwframe+0x44/0xae
> [   75.975120] RIP: 0033:0x7f50acf5692f
> [   75.979581] Code: c7 44 24 10 18 00 00 00 48 89 44 24 18 48 8d 44 24 30 8b 70 08 48 8b 50 10 4c 0f 43 50 18 48 89 44 24 20 b8 65 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 41 48 85 c0 78 06 41 83 f8 02 76 1e 48 8b 4c
> [   76.001535] RSP: 002b:00007fff18a9f6f0 EFLAGS: 00000202 ORIG_RAX: 0000000000000065
> [   76.010465] RAX: ffffffffffffffda RBX: 0000000000000862 RCX: 00007f50acf5692f
> [   76.018960] RDX: 0000000000000202 RSI: 0000000000000862 RDI: 0000000000004205
> [   76.027433] RBP: 000055576f8960c0 R08: 0000000000004204 R09: 00007f50ad027500
> [   76.035947] R10: 00007fff18a9f770 R11: 0000000000000202 R12: 0000000000000340
> [   76.044428] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
> [   76.052957] Modules linked in: xfs libcrc32c sr_mod sd_mod cdrom t10_pi sg intel_rapl_msr intel_rapl_common sb_edac x86_pkg_temp_thermal intel_powerclamp coretemp kvm_intel kvm mgag200 irqbypass crct10dif_pclmul drm_kms_helper crc32_pclmul ipmi_ssif crc32c_intel ghash_clmulni_intel rapl syscopyarea sysfillrect intel_cstate ahci sysimgblt fb_sys_fops libahci mpt3sas acpi_ipmi intel_uncore raid_class drm libata ipmi_si joydev scsi_transport_sas wmi ipmi_devintf ipmi_msghandler acpi_pad ip_tables
> [   76.104215] CR2: 0000000000000000
> [   76.108641] ---[ end trace dd34396ee89519a4 ]---
> [   76.114448] RIP: 0010:xstateregs_set+0x9f/0x140
> [   76.120185] Code: e0 5d 41 5c 41 5d 41 5e 41 5f c3 41 89 cf 4d 89 ce 4c 89 ff e8 32 87 2e 00 48 89 c5 48 85 c0 0f 84 8a 00 00 00 45 85 e4 74 20 <48> 8b 34 25 00 00 00 00 48 85 f6 74 2f 4c 89 fa 48 89 c7 e8 89 78
> [   76.142571] RSP: 0018:ffffc90023a47e38 EFLAGS: 00010202
> [   76.149152] RAX: ffffc9000c9dd000 RBX: ffff88c107824f80 RCX: 8000000000000063
> [   76.157855] RDX: 0000000000000001 RSI: ffff888100000000 RDI: ffff888100203328
> [   76.166562] RBP: ffffc9000c9dd000 R08: ffff88810cdffef0 R09: 8000000000000063
> [   76.175265] R10: 0000000000000ee8 R11: ffff88a08159c3f0 R12: 0000000000000340
> [   76.183967] R13: ffff88c1078273c0 R14: 000055576f8960c0 R15: 0000000000000340
> [   76.192662] FS:  00007f50ad027500(0000) GS:ffff88bfff980000(0000) knlGS:0000000000000000
> [   76.202425] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> [   76.209590] CR2: 0000000000000000 CR3: 000000208df04004 CR4: 00000000001706e0
> [   76.218266] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
> [   76.226957] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
> [   76.235597] Kernel panic - not syncing: Fatal exception
> [   76.284889] Kernel Offset: disabled
> ACPI MEMORY or I/O RESET_REG.