linux-kernel - Re: [patch V3 16/66] x86/fpu: Clean up fpregs

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <YNCAfJAn1872g7Fv@zn.tnic>
Date:   Mon, 21 Jun 2021 14:05:16 +0200
From:   Borislav Petkov <bp@...e.de>
To:     Thomas Gleixner <tglx@...utronix.de>
Cc:     LKML <linux-kernel@...r.kernel.org>,
        Andy Lutomirski <luto@...nel.org>,
        Dave Hansen <dave.hansen@...ux.intel.com>,
        Fenghua Yu <fenghua.yu@...el.com>,
        Tony Luck <tony.luck@...el.com>,
        Yu-cheng Yu <yu-cheng.yu@...el.com>,
        Sebastian Andrzej Siewior <bigeasy@...utronix.de>,
        Peter Zijlstra <peterz@...radead.org>,
        Kan Liang <kan.liang@...ux.intel.com>
Subject: Re: [patch V3 16/66] x86/fpu: Clean up fpregs_set()

On Fri, Jun 18, 2021 at 04:18:39PM +0200, Thomas Gleixner wrote:
> From: Andy Lutomirski <luto@...nel.org>
> 
> fpregs_set() has unnecessary complexity to support short or nonzero-offset
> writes and to handle the case in which a copy from userspace overwrites
> some of the target buffer and then fails.  Support for partial writes is
> useless -- just require that the write have offset 0 and the correct size,
> and copy into a temporary kernel buffer to avoid clobbering the state if
> the user access fails.
> 
> Signed-off-by: Andy Lutomirski <luto@...nel.org>
> Signed-off-by: Thomas Gleixner <tglx@...utronix.de>
> ---
> V2: New patch. Picked up from Andy
> ---
>  arch/x86/kernel/fpu/regset.c |   29 +++++++++++++++--------------
>  1 file changed, 15 insertions(+), 14 deletions(-)
> ---
> --- a/arch/x86/kernel/fpu/regset.c
> +++ b/arch/x86/kernel/fpu/regset.c
> @@ -305,31 +305,32 @@ int fpregs_set(struct task_struct *targe
>  	struct user_i387_ia32_struct env;
>  	int ret;
>  
> -	fpu__prepare_write(fpu);
> -	fpstate_sanitize_xstate(fpu);
> +	/* No funny business with partial or oversized writes is permitted. */
> +	if (pos != 0 || count != sizeof(struct user_i387_ia32_struct))
> +		return -EINVAL;
>  
> -	if (!boot_cpu_has(X86_FEATURE_FPU))
> +	if (!cpu_feature_enabled(X86_FEATURE_FPU))
>  		return fpregs_soft_set(target, regset, pos, count, kbuf, ubuf);
>  
> -	if (!boot_cpu_has(X86_FEATURE_FXSR))
> -		return user_regset_copyin(&pos, &count, &kbuf, &ubuf,
> -					  &fpu->state.fsave, 0,
> -					  -1);
> +	ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf, &env, 0, -1);
> +	if (ret)
> +		return ret;
>  
> -	if (pos > 0 || count < sizeof(env))
> -		convert_from_fxsr(&env, target);
> +	fpu__prepare_write(fpu);
>  
> -	ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf, &env, 0, -1);
> -	if (!ret)
> +	if (cpu_feature_enabled(X86_FEATURE_FXSR))
>  		convert_to_fxsr(&target->thread.fpu.state.fxsave, &env);
> +	else
> +		memcpy(&target->thread.fpu.state.fsave, &env, sizeof(env));

You have above in the prologue:

	struct fpu *fpu = &target->thread.fpu;

so here you can just as well do:

        if (cpu_feature_enabled(X86_FEATURE_FXSR))
                convert_to_fxsr(&fpu->state.fxsave, &env);
        else
                memcpy(&fpu->state.fsave, &env, sizeof(env));

asm is identical.

With that:

Reviewed-by: Borislav Petkov <bp@...e.de>

-- 
Regards/Gruss,
    Boris.

SUSE Software Solutions Germany GmbH, GF: Felix Imendörffer, HRB 36809, AG Nürnberg