linux-kernel - Re: [patch V3 01/66] x86/fpu: x86/fpu: Preserve supervisor states in sanitize_restored_user

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <YM2sLY56q4LIxv6t@zn.tnic>
Date:   Sat, 19 Jun 2021 10:34:53 +0200
From:   Borislav Petkov <bp@...e.de>
To:     Thomas Gleixner <tglx@...utronix.de>
Cc:     LKML <linux-kernel@...r.kernel.org>,
        Andy Lutomirski <luto@...nel.org>,
        Dave Hansen <dave.hansen@...ux.intel.com>,
        Fenghua Yu <fenghua.yu@...el.com>,
        Tony Luck <tony.luck@...el.com>,
        Yu-cheng Yu <yu-cheng.yu@...el.com>,
        Sebastian Andrzej Siewior <bigeasy@...utronix.de>,
        Peter Zijlstra <peterz@...radead.org>,
        Kan Liang <kan.liang@...ux.intel.com>
Subject: Re: [patch V3 01/66] x86/fpu: x86/fpu: Preserve supervisor states in
 sanitize_restored_user_xstate()

On Fri, Jun 18, 2021 at 04:18:24PM +0200, Thomas Gleixner wrote:
> Subject: Re: [patch V3 01/66] x86/fpu: x86/fpu: Preserve supervisor states in

Prefix repeated.

> From: Thomas Gleixner <tglx@...utronix.de>
> 
> sanitize_restored_user_xstate() preserves the supervisor states only
> when the fx_only argument is zero, which allows unpriviledged user space
> to put supervisor states back into init state.

Yikes.

> Preserve them unconditionally.
> 
> Fixes: 5d6b6a6f9b5c ("x86/fpu/xstate: Update sanitize_restored_xstate() for supervisor xstates")
> Signed-off-by: Thomas Gleixner <tglx@...utronix.de>
> Cc: stable@...r.kernel.org
> ---
>  arch/x86/kernel/fpu/signal.c |   26 ++++++++------------------
>  1 file changed, 8 insertions(+), 18 deletions(-)
> 
> --- a/arch/x86/kernel/fpu/signal.c
> +++ b/arch/x86/kernel/fpu/signal.c
> @@ -221,28 +221,18 @@ sanitize_restored_user_xstate(union fpre
>  
>  	if (use_xsave()) {
>  		/*
> -		 * Note: we don't need to zero the reserved bits in the
> -		 * xstate_header here because we either didn't copy them at all,
> -		 * or we checked earlier that they aren't set.
> +		 * Clear all features bit which are not set in

			    feature bits

> +		 * user_xfeatures and clear all extended features
> +		 * for fx_only mode.
>  		 */
> +		u64 mask = fx_only ? XFEATURE_MASK_FPSSE : user_xfeatures;
>  
>  		/*
> -		 * 'user_xfeatures' might have bits clear which are
> -		 * set in header->xfeatures. This represents features that
> -		 * were in init state prior to a signal delivery, and need
> -		 * to be reset back to the init state.  Clear any user
> -		 * feature bits which are set in the kernel buffer to get
> -		 * them back to the init state.
> -		 *
> -		 * Supervisor state is unchanged by input from userspace.
> -		 * Ensure supervisor state bits stay set and supervisor
> -		 * state is not modified.
> +		 * Supervisor state has to be preserved. The sigframe
> +		 * restore can only modify user features, i.e. @mask
> +		 * cannot contain them.
>  		 */
> -		if (fx_only)
> -			header->xfeatures = XFEATURE_MASK_FPSSE;
> -		else
> -			header->xfeatures &= user_xfeatures |
> -					     xfeatures_mask_supervisor();
> +		header->xfeatures &= mask | xfeatures_mask_supervisor();

With those addressed:

Reviewed-by: Borislav Petkov <bp@...e.de>

Thx.

-- 
Regards/Gruss,
    Boris.

SUSE Software Solutions Germany GmbH, GF: Felix Imendörffer, HRB 36809, AG Nürnberg