linux-kernel - [PATCH] x86/fpu: Fix the os panic issue caused by the XGETBV instruction

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20250102075419.2559-1-TonyWWang-oc@zhaoxin.com>
Date: Thu, 2 Jan 2025 15:54:19 +0800
From: Tony W Wang-oc <TonyWWang-oc@...oxin.com>
To: <tglx@...utronix.de>, <mingo@...hat.com>, <bp@...en8.de>,
        <dave.hansen@...ux.intel.com>, <x86@...nel.org>, <hpa@...or.com>,
        <aruna.ramakrishna@...cle.com>, <pbonzini@...hat.com>,
        <levymitchell0@...il.com>, <attofari@...zon.de>,
        <linux-kernel@...r.kernel.org>
CC: <CobeChen@...oxin.com>, <TimGuo@...oxin.com>, <LeoLiu-oc@...oxin.com>,
        Lyle Li <LyleLi@...oxin.com>
Subject: [PATCH] x86/fpu: Fix the os panic issue caused by the XGETBV instruction

From: Lyle Li <LyleLi@...oxin.com>

The callers of the xfeatures_in_use function must ensure that the
current processor has the X86_FEATURE_XGETBV1 feature. However, in some
places where xfeatures_in_use is called, there is no check to see if the
processor supports this feature, leading to the execution of the XGETBV
XCR1 instruction on processors that do not support this feature,
triggering a #GP exception, and ultimately causing an OS panic.

To fix this issue, a check for the X86_FEATURE_XGETBV1 feature has been
added before calling xfeatures_in_use.

Fixes: ae6012d72fa6 ("x86/pkeys: Ensure updated PKRU value is XRSTOR'd") 
Fixes: 30d02551ba4f ("x86/fpu: Optimize out sigframe xfeatures when in init state")
Signed-off-by: Lyle Li <LyleLi@...oxin.com>
Signed-off-by: Tony W Wang-oc <TonyWWang-oc@...oxin.com>
---
 arch/x86/kernel/fpu/xstate.h | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/arch/x86/kernel/fpu/xstate.h b/arch/x86/kernel/fpu/xstate.h
index aa16f1a1b..4d966c6c7 100644
--- a/arch/x86/kernel/fpu/xstate.h
+++ b/arch/x86/kernel/fpu/xstate.h
@@ -80,6 +80,9 @@ static inline int update_pkru_in_sigframe(struct xregs_state __user *buf, u64 ma
 	if (unlikely(!cpu_feature_enabled(X86_FEATURE_OSPKE)))
 		return 0;
 
+	if (!cpu_feature_enabled(X86_FEATURE_XGETBV1))
+		return 0;
+
 	/* Mark PKRU as in-use so that it is restored correctly. */
 	xstate_bv = (mask & xfeatures_in_use()) | XFEATURE_MASK_PKRU;
 
@@ -292,7 +295,7 @@ static inline int xsave_to_user_sigframe(struct xregs_state __user *buf, u32 pkr
 	int err;
 
 	/* Optimize away writing unnecessary xfeatures: */
-	if (fpu_state_size_dynamic())
+	if (cpu_feature_enabled(X86_FEATURE_XGETBV1) && fpu_state_size_dynamic())
 		mask &= xfeatures_need_sigframe_write();
 
 	lmask = mask;
-- 
2.25.1