linux-kernel - Re: [patch V3 4/6] x86/pkru: Make PKRU=0 actually work

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <YL+PYz/cZPhSVmf2@zn.tnic>
Date:   Tue, 8 Jun 2021 17:40:19 +0200
From:   Borislav Petkov <bp@...en8.de>
To:     Thomas Gleixner <tglx@...utronix.de>
Cc:     LKML <linux-kernel@...r.kernel.org>, x86@...nel.org,
        Andy Lutomirski <luto@...nel.org>,
        Dave Hansen <dave.hansen@...ux.intel.com>,
        Fenghua Yu <fenghua.yu@...el.com>,
        Tony Luck <tony.luck@...el.com>,
        Yu-cheng Yu <yu-cheng.yu@...el.com>,
        Sebastian Andrzej Siewior <bigeasy@...utronix.de>,
        Rik van Riel <riel@...riel.com>
Subject: Re: [patch V3 4/6] x86/pkru: Make PKRU=0 actually work

Just typos:

On Tue, Jun 08, 2021 at 04:36:21PM +0200, Thomas Gleixner wrote:
> So that wreckages any copy_to/from_user() on the way back to user space

wrecks

> which hits memory which is protected by the default PKRU value.
> 
> Assumed that this does not fail (pure luck) then T1 goes back to user
> space and because TIF_NEED_FPU_LOAD is set it ends up in
> 
> switch_fpu_return()
>     __fpregs_load_activate()
>       if (!fpregs_state_valid()) {
> 	 load_XSTATE_from_task();
>       }
> 
> But if nothing touched the FPU between T1 scheduling out and in the
							       ^^

							s/in/if/ it seems.

> fpregs_state is valid so switch_fpu_return() does nothing and just clears
> TIF_NEED_FPU_LOAD. Back to user space with DEFAULT_PKRU loaded. -> FAIL #2!
> 
> The fix is simple: if get_xsave_addr() returns NULL then set the PKRU value
> to 0 instead of the restrictive default PKRU value.
> 
> Fixes: 0cecca9d03c9 ("x86/fpu: Eager switch PKRU state")
> Signed-off-by: Thomas Gleixner <tglx@...utronix.de>
> Cc: Rik van Riel <riel@...riel.com>
> Cc: stable@...r.kernel.org
> ---
>  arch/x86/include/asm/fpu/internal.h |   11 +++++++++--
>  1 file changed, 9 insertions(+), 2 deletions(-)
> 
> --- a/arch/x86/include/asm/fpu/internal.h
> +++ b/arch/x86/include/asm/fpu/internal.h
> @@ -579,9 +579,16 @@ static inline void switch_fpu_finish(str
>  	 * return to userland e.g. for a copy_to_user() operation.
>  	 */
>  	if (!(current->flags & PF_KTHREAD)) {
> +		/*
> +		 * If the PKRU bit in xsave.header.xfeatures is not set,
> +		 * then the PKRU compoment was in init state, which means
                                 ^^^^^^^^^

component

> +		 * XRSTOR will set PKRU to 0. If the bit is not set then
> +		 * get_xsave_addr() will return NULL because the PKRU value
> +		 * in memory is not valid. This means pkru_val has to be
> +		 * set to 0 and not to init_pkru_value.
> +		 */
>  		pk = get_xsave_addr(&new_fpu->state.xsave, XFEATURE_PKRU);
> -		if (pk)
> -			pkru_val = pk->pkru;
> +		pkru_val = pk ? pk->pkru : 0;
>  	}

Hohumm, let's see who cries out... :-\

-- 
Regards/Gruss,
    Boris.

https://people.kernel.org/tglx/notes-about-netiquette