linux-kernel - Re: [RFC PATCH v3 14/17] s390/unwind_user/sframe: Enable HAVE_UNWIND_USER

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20251210151012.40732B79-hca@linux.ibm.com>
Date: Wed, 10 Dec 2025 16:10:12 +0100
From: Heiko Carstens <hca@...ux.ibm.com>
To: Jens Remus <jremus@...ux.ibm.com>
Cc: linux-kernel@...r.kernel.org, linux-trace-kernel@...r.kernel.org,
        linux-s390@...r.kernel.org, bpf@...r.kernel.org, x86@...nel.org,
        Steven Rostedt <rostedt@...nel.org>, Vasily Gorbik <gor@...ux.ibm.com>,
        Ilya Leoshkevich <iii@...ux.ibm.com>,
        Josh Poimboeuf <jpoimboe@...nel.org>,
        Masami Hiramatsu <mhiramat@...nel.org>,
        Mathieu Desnoyers <mathieu.desnoyers@...icios.com>,
        Peter Zijlstra <peterz@...radead.org>, Ingo Molnar <mingo@...nel.org>,
        Jiri Olsa <jolsa@...nel.org>,
        Arnaldo Carvalho de Melo <acme@...nel.org>,
        Namhyung Kim <namhyung@...nel.org>,
        Thomas Gleixner <tglx@...utronix.de>,
        Andrii Nakryiko <andrii@...nel.org>,
        Indu Bhagat <indu.bhagat@...cle.com>,
        "Jose E. Marchesi" <jemarch@....org>,
        Beau Belgrave <beaub@...ux.microsoft.com>,
        Linus Torvalds <torvalds@...ux-foundation.org>,
        Andrew Morton <akpm@...ux-foundation.org>,
        Florian Weimer <fweimer@...hat.com>, Kees Cook <kees@...nel.org>,
        "Carlos O'Donell" <codonell@...hat.com>, Sam James <sam@...too.org>,
        Dylan Hatch <dylanbhatch@...gle.com>
Subject: Re: [RFC PATCH v3 14/17] s390/unwind_user/sframe: Enable
 HAVE_UNWIND_USER_SFRAME

Hi Jens,

On Mon, Dec 08, 2025 at 06:15:56PM +0100, Jens Remus wrote:
> +static inline int __s390_get_dwarf_fpr(unsigned long *val, int regnum)
> +{
> +	switch (regnum) {
> +	case 16:
> +		fpu_std(0, (freg_t *)val);
> +		break;
> +	case 17:
> +		fpu_std(2, (freg_t *)val);
> +		break;
> +	case 18:
> +		fpu_std(4, (freg_t *)val);
> +		break;
> +	case 19:
> +		fpu_std(6, (freg_t *)val);
> +		break;
> +	case 20:
> +		fpu_std(1, (freg_t *)val);
> +		break;

IIRC, I mentioned this already last time. But it is not correct to access user
space floating point register contents like this. Due to in-kernel fpu/vector
register usage the user space register contents may have been saved away to
the per-thread vxrs save area, and registers may have been used for in-kernel
usage instead.
Read: the above code could access lazy register contents of in-kernel usage.

Change the above to something like:

	struct fpu *fpu = &current->thread.ufpu;

	save_user_fpu_regs();
	switch (regnum) {
	case 16: return fpu->vxrs[0].high;
	case 17: return fpu->vxrs[2].high;
	case 18: return fpu->vxrs[4].high;
	case 19: return fpu->vxrs[6].high;
	case 20: return fpu->vxrs[1].high;
	...

save_user_fpu_regs() will write all user space fpu/vector register contents to
the per-thread save area (if not already saved), and then it is possible to
read contents from there.

I'll see if I can provide something better for this use case, since this code
needs to access only the first 16 registers; so no need to write contents of
all registers to the save area.