| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Wed, 22 Sep 2021 11:23:01 -0700
From: Nick Desaulniers <ndesaulniers@...gle.com>
To: Anders Roxell <anders.roxell@...aro.org>
Cc: Thomas Gleixner <tglx@...utronix.de>,
LKML <linux-kernel@...r.kernel.org>,
"maintainer:X86 ARCHITECTURE (32-BIT AND 64-BIT)" <x86@...nel.org>,
Al Viro <viro@...iv.linux.org.uk>,
Linus Torvalds <torvalds@...ux-foundation.org>,
Tony Luck <tony.luck@...el.com>,
Alexei Starovoitov <ast@...nel.org>,
Peter Ziljstra <peterz@...radead.org>,
Song Liu <songliubraving@...com>,
Daniel Borkmann <daniel@...earbox.net>,
Nathan Chancellor <nathan@...nel.org>,
Andrew Cooper <andrew.cooper3@...rix.com>
Subject: Re: [patch V3 15/20] x86/fpu/signal: Change return type of
copy_fpregs_to_sigframe() helpers to boolean
+ Andrew (sorry, I messed up your address on the previous message)
On Tue, Sep 21, 2021 at 10:36 AM Nick Desaulniers
<ndesaulniers@...gle.com> wrote:
>
> On Tue, Sep 21, 2021 at 12:58:34PM +0200, Anders Roxell wrote:
> > On Wed, 8 Sept 2021 at 15:30, Thomas Gleixner <tglx@...utronix.de> wrote:
> > >
> > > Now that copy_fpregs_to_sigframe() returns boolean the individual return
> > > codes in the related helper functions do not make sense anymore. Change
> > > them to return boolean success/fail.
> > >
> > > Signed-off-by: Thomas Gleixner <tglx@...utronix.de>
> >
> > When I build and boot (qemu_x86_64) a defconfig kernel on from todays
> > next tag next-20210921 I see the following segmentation fault
> >
> > 2021-09-21T10:11:45 <6>[ 1.622922] mount (89) used greatest stack
> > depth: 14384 bytes left
> > 2021-09-21T10:11:45 <6>[ 1.664760] EXT4-fs (sda): re-mounted. Opts:
> > (null). Quota mode: none.
> > 2021-09-21T10:11:45 <6>[ 1.691041] mkdir (92) used greatest stack
> > depth: 14312 bytes left
> > 2021-09-21T10:11:45 <6>[ 1.713201] mount (93) used greatest stack
> > depth: 13720 bytes left
> > 2021-09-21T10:11:46 Starting syslogd: /etc/init.d/rcS: line 12: 101
> > Segmentation fault $i start
> >
> >
> > I did a bisection and found this as the faulty patch [1]. When I
> > revert this patch I can't see the issue.
> >
> > We noticed that function 'save_xstate_epilog()' changes the polarity
> > of its return code for one of the return statements, and for its only
> > caller. but not for the other return statement.
> >
> > I tried this patch and I couldn't see the segmentation fault.
> >
> > diff --git a/arch/x86/kernel/fpu/signal.c b/arch/x86/kernel/fpu/signal.c
> > index 445c57c9c539..61eeebc04427 100644
> > --- a/arch/x86/kernel/fpu/signal.c
> > +++ b/arch/x86/kernel/fpu/signal.c
> > @@ -104,7 +104,7 @@ static inline int save_xstate_epilog(void __user
> > *buf, int ia32_frame)
> > err = __copy_to_user(&x->i387.sw_reserved, sw_bytes, sizeof(*sw_bytes));
> >
> > if (!use_xsave())
> > - return err;
> > + return !err;
> >
> > err |= __put_user(FP_XSTATE_MAGIC2,
> > (__u32 __user *)(buf + fpu_user_xstate_size));
>
> Thank for the report. Our CI watching tip has also been super red over
> the past day or so; all boot failures.
>
> Andrew Cooper reported this diff to me on IRC; I tested out the above
> and it fixes the boot failure for us.
>
> Tested-by: Nick Desaulniers <ndesaulniers@...gle.com>
> Link: https://github.com/ClangBuiltLinux/linux/issues/1461
>
> Our CI used -cpu Nehalem for qemu since KVM isn't exposed to the bots on
> github actions, FWIW.
> https://github.com/ClangBuiltLinux/boot-utils/blob/2edbca214f9a4cabd3f138ea029015d6cf52d110/boot-qemu.sh#L278-L288
>
> >
> >
> >
> > Cheers,
> > Anders
> > [1] http://ix.io/3zxf
> >
> > > ---
> > > arch/x86/kernel/fpu/signal.c | 17 +++++++++--------
> > > 1 file changed, 9 insertions(+), 8 deletions(-)
> > >
> > > --- a/arch/x86/kernel/fpu/signal.c
> > > +++ b/arch/x86/kernel/fpu/signal.c
> > > @@ -65,7 +65,7 @@ static inline int check_xstate_in_sigfra
> > > /*
> > > * Signal frame handlers.
> > > */
> > > -static inline int save_fsave_header(struct task_struct *tsk, void __user *buf)
> > > +static inline bool save_fsave_header(struct task_struct *tsk, void __user *buf)
> > > {
> > > if (use_fxsr()) {
> > > struct xregs_state *xsave = &tsk->thread.fpu.state.xsave;
> > > @@ -82,18 +82,19 @@ static inline int save_fsave_header(stru
> > > if (__copy_to_user(buf, &env, sizeof(env)) ||
> > > __put_user(xsave->i387.swd, &fp->status) ||
> > > __put_user(X86_FXSR_MAGIC, &fp->magic))
> > > - return -1;
> > > + return false;
> > > } else {
> > > struct fregs_state __user *fp = buf;
> > > u32 swd;
> > > +
> > > if (__get_user(swd, &fp->swd) || __put_user(swd, &fp->status))
> > > - return -1;
> > > + return false;
> > > }
> > >
> > > - return 0;
> > > + return true;
> > > }
> > >
> > > -static inline int save_xstate_epilog(void __user *buf, int ia32_frame)
> > > +static inline bool save_xstate_epilog(void __user *buf, int ia32_frame)
> > > {
> > > struct xregs_state __user *x = buf;
> > > struct _fpx_sw_bytes *sw_bytes;
> > > @@ -131,7 +132,7 @@ static inline int save_xstate_epilog(voi
> > >
> > > err |= __put_user(xfeatures, (__u32 __user *)&x->header.xfeatures);
> > >
> > > - return err;
> > > + return !err;
> > > }
> > >
> > > static inline int copy_fpregs_to_sigframe(struct xregs_state __user *buf)
> > > @@ -219,10 +220,10 @@ bool copy_fpstate_to_sigframe(void __use
> > > }
> > >
> > > /* Save the fsave header for the 32-bit frames. */
> > > - if ((ia32_fxstate || !use_fxsr()) && save_fsave_header(tsk, buf))
> > > + if ((ia32_fxstate || !use_fxsr()) && !save_fsave_header(tsk, buf))
> > > return false;
> > >
> > > - if (use_fxsr() && save_xstate_epilog(buf_fx, ia32_fxstate))
> > > + if (use_fxsr() && !save_xstate_epilog(buf_fx, ia32_fxstate))
> > > return false;
> > >
> > > return true;
> > >
--
Thanks,
~Nick Desaulniers
Powered by blists - more mailing lists