linux-kernel - Re: [patch 01/10] x86/fpu/signal: Clarify exception handling in restore_fpregs_from

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <87o89efupd.ffs@tglx>
Date:   Tue, 31 Aug 2021 00:12:30 +0200
From:   Thomas Gleixner <tglx@...utronix.de>
To:     Linus Torvalds <torvalds@...ux-foundation.org>,
        Al Viro <viro@...iv.linux.org.uk>
Cc:     Dan Williams <dan.j.williams@...el.com>,
        Borislav Petkov <bp@...en8.de>,
        LKML <linux-kernel@...r.kernel.org>,
        the arch/x86 maintainers <x86@...nel.org>
Subject: Re: [patch 01/10] x86/fpu/signal: Clarify exception handling in
 restore_fpregs_from_user()

On Mon, Aug 30 2021 at 15:00, Linus Torvalds wrote:
> On Mon, Aug 30, 2021 at 2:33 PM Al Viro <viro@...iv.linux.org.uk> wrote:
>>
>> There's a place where we care about #PF vs. #MC (see upthread)...
>
> Interestingly (or perhaps not), that case is a problem case in general
> for "fault_in_pages_readable()".
>
> That function will only access data every PAGE_SIZE bytes, but if we
> have other exceptions that can happen at a cacheline granularity, the
> whole "retry after faulting pages in" may fail.
>
> So that kind of
>
>  - try to copy from user space
>
>  - if that fails, do fault_in_pages_readable() and retry
>
> loop can loop forever.
>
> restore_fpregs_from_user() is odd and special in trying to deal with
> it by looking at the error code. I'm n ot convinced it's the right
> thing to do, since it just means that all the other places we do this
> can be problematic.

It's not only about #MC. *RSTOR can also trigger #GP in case that the
user buffer contains garbage and we clearly don't want to loop forever
on that either.

Thanks,

        tglx