linux-kernel - Re: [PATCH] MIPS: kernel: Clear FPU states when setting up kernel threads

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <6f290f4b-5dc2-44f3-9f2d-01496f78d629@app.fastmail.com>
Date:   Fri, 01 Dec 2023 11:12:21 +0000
From:   "Jiaxun Yang" <jiaxun.yang@...goat.com>
To:     "Thomas Bogendoerfer" <tsbogend@...ha.franken.de>,
        "linux-mips@...r.kernel.org" <linux-mips@...r.kernel.org>,
        linux-kernel@...r.kernel.org
Cc:     "stable@...r.kernel.org" <stable@...r.kernel.org>,
        "Aurelien Jarno" <aurel32@...ian.org>
Subject: Re: [PATCH] MIPS: kernel: Clear FPU states when setting up kernel threads



在2023年11月30日十一月 下午4:36，Thomas Bogendoerfer写道：
> io_uring sets up the io worker kernel thread via a syscall out of an
> user space prrocess. This process might have used FPU and since
> copy_thread() didn't clear FPU states for kernel threads a BUG()
> is triggered for using FPU inside kernel. Move code around
> to always clear FPU state for user and kernel threads.
>
> Cc: stable@...r.kernel.org
> Reported-by: Aurelien Jarno <aurel32@...ian.org>
> Closes: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1055021
> Signed-off-by: Thomas Bogendoerfer <tsbogend@...ha.franken.de>

Reviewed-by: Jiaxun Yang <jiaxun.yang@...goat.com>

Perhaps
Suggested-by: Jiaxun Yang <jiaxun.yang@...goat.com>

As well :-)

Thanks
- Jiaxun
> ---
>  arch/mips/kernel/process.c | 25 +++++++++++++------------
>  1 file changed, 13 insertions(+), 12 deletions(-)
>
> diff --git a/arch/mips/kernel/process.c b/arch/mips/kernel/process.c
> index 5387ed0a5186..b630604c577f 100644
> --- a/arch/mips/kernel/process.c
> +++ b/arch/mips/kernel/process.c
> @@ -121,6 +121,19 @@ int copy_thread(struct task_struct *p, const 
> struct kernel_clone_args *args)
>  	/*  Put the stack after the struct pt_regs.  */
>  	childksp = (unsigned long) childregs;
>  	p->thread.cp0_status = (read_c0_status() & ~(ST0_CU2|ST0_CU1)) | 
> ST0_KERNEL_CUMASK;
> +
> +	/*
> +	 * New tasks lose permission to use the fpu. This accelerates context
> +	 * switching for most programs since they don't use the fpu.
> +	 */
> +	clear_tsk_thread_flag(p, TIF_USEDFPU);
> +	clear_tsk_thread_flag(p, TIF_USEDMSA);
> +	clear_tsk_thread_flag(p, TIF_MSA_CTX_LIVE);
> +
> +#ifdef CONFIG_MIPS_MT_FPAFF
> +	clear_tsk_thread_flag(p, TIF_FPUBOUND);
> +#endif /* CONFIG_MIPS_MT_FPAFF */
> +
>  	if (unlikely(args->fn)) {
>  		/* kernel thread */
>  		unsigned long status = p->thread.cp0_status;
> @@ -149,20 +162,8 @@ int copy_thread(struct task_struct *p, const 
> struct kernel_clone_args *args)
>  	p->thread.reg29 = (unsigned long) childregs;
>  	p->thread.reg31 = (unsigned long) ret_from_fork;
> 
> -	/*
> -	 * New tasks lose permission to use the fpu. This accelerates context
> -	 * switching for most programs since they don't use the fpu.
> -	 */
>  	childregs->cp0_status &= ~(ST0_CU2|ST0_CU1);
> 
> -	clear_tsk_thread_flag(p, TIF_USEDFPU);
> -	clear_tsk_thread_flag(p, TIF_USEDMSA);
> -	clear_tsk_thread_flag(p, TIF_MSA_CTX_LIVE);
> -
> -#ifdef CONFIG_MIPS_MT_FPAFF
> -	clear_tsk_thread_flag(p, TIF_FPUBOUND);
> -#endif /* CONFIG_MIPS_MT_FPAFF */
> -
>  #ifdef CONFIG_MIPS_FP_SUPPORT
>  	atomic_set(&p->thread.bd_emu_frame, BD_EMUFRAME_NONE);
>  #endif
> -- 
> 2.35.3

-- 
- Jiaxun