linux-kernel - [PATCH] fpu: xstate: Keep xfd_state always in-sync with IA32

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 11 May 2023 15:28:17 +0000
From:   Adamos Ttofari <attofari@...zon.de>
To:     unlisted-recipients:; (no To-header on input)
CC:     <abusse@...zon.de>, <dwmw@...zon.co.uk>, <hborghor@...zon.de>,
        <sironi@...zon.de>, <attofari@...zon.de>,
        Thomas Gleixner <tglx@...utronix.de>,
        Ingo Molnar <mingo@...hat.com>, Borislav Petkov <bp@...en8.de>,
        Dave Hansen <dave.hansen@...ux.intel.com>, <x86@...nel.org>,
        "H. Peter Anvin" <hpa@...or.com>, Kyle Huey <me@...ehuey.com>,
        "Chang S. Bae" <chang.seok.bae@...el.com>,
        Andrew Cooper <andrew.cooper3@...rix.com>,
        <linux-kernel@...r.kernel.org>
Subject: [PATCH] fpu: xstate: Keep xfd_state always in-sync with IA32_XFD MSR

Commit 672365477ae8 ("x86/fpu: Update XFD state where required") and
commit 8bf26758ca96 ("x86/fpu: Add XFD state to fpstate") introduced a
per_cpu variable xfd_state to keep the IA32_XFD MSR value cached. In
order to avoid unnecessary writes to the MSR.

xfd_state might not be always synced with the MSR. Eventually affecting
MSR writes. xfd_state is initialized with 0, meanwhile the MSR is
initialized with the XFEATURE_MASK_USER_DYNAMIC to make XFD fire. Then
later on reschedule to a different CPU, when a process that uses extended
xfeatures and handled the #NM (by allocating the additional space in task's
fpstate for extended xfeatures) it will skip the MSR update in
restore_fpregs_from_fpstate because the value might match to already cached
xfd_state (meanwhile it is not the same with the MSR). Eventually calling a
XRSTOR to set the new state (that caries extended xfeatures) and fire a #NM
from kernel context. The XFD is expected to fire from user-space context,
but not in this case and the kernel crashes.

To address the issue mentioned initialize xfd_state with the current MSR
value and update the XFD MSR always with xfd_update_state to avoid
un-sync cases.

Fixes: 672365477ae8 ("x86/fpu: Update XFD state where required")

Signed-off-by: Adamos Ttofari <attofari@...zon.de>
---
 arch/x86/kernel/fpu/xstate.c | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/arch/x86/kernel/fpu/xstate.c b/arch/x86/kernel/fpu/xstate.c
index 0bab497c9436..36ed27ac0ecd 100644
--- a/arch/x86/kernel/fpu/xstate.c
+++ b/arch/x86/kernel/fpu/xstate.c
@@ -179,8 +179,14 @@ void fpu__init_cpu_xstate(void)
 	 * key as that does not work on the boot CPU. This also ensures
 	 * that any stale state is wiped out from XFD.
 	 */
-	if (cpu_feature_enabled(X86_FEATURE_XFD))
-		wrmsrl(MSR_IA32_XFD, init_fpstate.xfd);
+	if (cpu_feature_enabled(X86_FEATURE_XFD)) {
+		u64 xfd;
+
+		rdmsrl(MSR_IA32_XFD, xfd);
+		__this_cpu_write(xfd_state, xfd);
+
+		xfd_update_state(&init_fpstate);
+	}

 	/*
 	 * XCR_XFEATURE_ENABLED_MASK (aka. XCR0) sets user features
@@ -915,7 +921,7 @@ void fpu__resume_cpu(void)
 	}

 	if (fpu_state_size_dynamic())
-		wrmsrl(MSR_IA32_XFD, current->thread.fpu.fpstate->xfd);
+		xfd_update_state(&init_fpstate);
 }

 /*
-- 
2.39.2

Amazon Development Center Germany GmbH
Krausenstr. 38
10117 Berlin
Geschaeftsfuehrung: Christian Schlaeger, Jonathan Weiss
Eingetragen am Amtsgericht Charlottenburg unter HRB 149173 B
Sitz: Berlin
Ust-ID: DE 289 237 879