linux-kernel - Re: [PATCH] x86/fpu: Remove dynamic features from xcomp_bv for init

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 13 Oct 2022 11:04:34 -0700
From:   Dave Hansen <dave.hansen@...el.com>
To:     "Yao, Yuan" <yuan.yao@...el.com>,
        Dave Hansen <dave.hansen@...ux.intel.com>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
Cc:     "Bae, Chang Seok" <chang.seok.bae@...el.com>,
        "x86@...nel.org" <x86@...nel.org>,
        Thomas Gleixner <tglx@...utronix.de>
Subject: Re: [PATCH] x86/fpu: Remove dynamic features from xcomp_bv for
 init_fpstate

On 10/12/22 20:35, Yao, Yuan wrote:
> Below trace is observed on host kernel with this patch applied when create VM.
> 
> The reason is __copy_xstate_to_uabi_buf() copies data from &init_fpstate when the component
> is not existed in the source kernel fpstate (here is the AMX tile component), but the
> AMX TILE bit is removed from init_fpstate due to this patch, so the WARN is triggered and return
> NULL which causes kernel NULL pointer dereference later.
> 
> I considered 2 possible ways to fix this without big change:
> 1. For such non-exist component, we can fill the buffer in target fpstate to 0 and don't WARN if the bit is not set
>     in init_fpstate.
> 2. Enlarge the init_fpstate to content the dynamic components and still keel fpu_kernel_cfg.max_features
>     in init_fpstate (but still remove the dynamic bit from new cloned thread), so we can use it safely in above case,
>     but near 2 pages (8K) is wasted.

There's a bigger problem here.

Removing the AMX bit from xstate_bv just *TELLS* the __raw_xsave_addr()
about the buffer being too small.  Before this patch, __raw_xsave_addr()
was probably reading crap out of whatever is past 'init_fpstate' and
copying it out to userspace.

This mess makes me want a guard page after 'init_fpstate'.

Anyway, this isn't really a separate bug.  It's just more nasty fallout
from xcomp_bv being wrong in the first place.