linux-kernel - Re: [PATCH] x86/fpu: Fix irq_fpu_usable() to return false during CPU onlining

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <87v7puq8g2.ffs@tglx>
Date: Wed, 21 May 2025 17:39:41 +0200
From: Thomas Gleixner <tglx@...utronix.de>
To: Eric Biggers <ebiggers@...nel.org>, x86@...nel.org
Cc: linux-kernel@...r.kernel.org, linux-crypto@...r.kernel.org,
 linux-pm@...r.kernel.org, Borislav Petkov <bp@...en8.de>, Ayush Jain
 <Ayush.Jain3@....com>, Herbert Xu <herbert@...dor.apana.org.au>, Ard
 Biesheuvel <ardb@...nel.org>
Subject: Re: [PATCH] x86/fpu: Fix irq_fpu_usable() to return false during
 CPU onlining

On Sun, May 18 2025 at 12:32, Eric Biggers wrote:
> From: Eric Biggers <ebiggers@...gle.com>
>
> irq_fpu_usable() incorrectly returned true before the FPU is
> initialized.  The x86 CPU onlining code can call sha256() to checksum
> AMD microcode images, before the FPU is initialized.  Since sha256()
> recently gained a kernel-mode FPU optimized code path, a crash occurred
> in kernel_fpu_begin_mask() during hotplug CPU onlining.
>
> (The crash did not occur during boot-time CPU onlining, since the
> optimized sha256() code is not enabled until subsys_initcalls run.)
>
> Fix this by making irq_fpu_usable() return false before fpu__init_cpu()
> has run.  To do this without adding any additional overhead to
> irq_fpu_usable(), replace the existing per-CPU bool in_kernel_fpu with
> kernel_fpu_allowed which tracks both initialization and usage rather
> than just usage.  The initial state is false; FPU initialization sets it
> to true; kernel-mode FPU sections toggle it to false and then back to
> true; and CPU offlining restores it to the initial state of false.
>
> Fixes: 11d7956d526f ("crypto: x86/sha256 - implement library instead of shash")
> Reported-by: Ayush Jain <Ayush.Jain3@....com>
> Closes: https://lore.kernel.org/r/20250516112217.GBaCcf6Yoc6LkIIryP@fat_crate.local
> Signed-off-by: Eric Biggers <ebiggers@...gle.com>

Reviewed-by: Thomas Gleixner <tglx@...utronix.de>