Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1737012

[PATCH v3 0/3] x86/fpu: prevent leaking FPU registers via invalid FPU state

Show all headers | View raw

From: Eric Biggers <ebiggers@google.com>

This series fixes the bug found by syzkaller where the ptrace syscall
can be used to set invalid bits in a task's FPU state.  I also found
that an equivalent bug was reachable using the sigreturn syscall, so the
first patch fixes the bug in both cases.

The other two patches start validating the other parts of the
xstate_header and make it so that invalid FPU states can no longer be
abused to leak the FPU registers of other processes.

Changes since v2:
    - Use an exception handler to handle invalid FPU states
      (suggested by Andy Lutomirski)
    - Check the size of xstate_header.reserved at build time
      (suggested by Dave Hansen)

Eric Biggers (3):
  x86/fpu: don't let userspace set bogus xcomp_bv
  x86/fpu: tighten validation of user-supplied xstate_header
  x86/fpu: reinitialize FPU registers if restoring FPU state fails

 arch/x86/include/asm/fpu/internal.h | 51 +++++++++++--------------------------
 arch/x86/include/asm/fpu/xstate.h   | 25 ++++++++++++++++++
 arch/x86/kernel/fpu/regset.c        | 20 +++++++--------
 arch/x86/kernel/fpu/signal.c        | 15 ++++++++---
 arch/x86/kernel/fpu/xstate.c        | 27 ++++++++------------
 arch/x86/mm/extable.c               | 24 +++++++++++++++++
 6 files changed, 94 insertions(+), 68 deletions(-)

-- 
2.14.1.821.g8fa685d3b7-goog

Back to linux.kernel | Previous | Next — Next in thread | Find similar | Unroll thread

Thread

[PATCH v3 0/3] x86/fpu: prevent leaking FPU registers via invalid FPU state Eric Biggers <ebiggers3@gmail.com> - 2017-09-21 21:00 +0200
  [PATCH v3 1/3] x86/fpu: don't let userspace set bogus xcomp_bv Eric Biggers <ebiggers3@gmail.com> - 2017-09-21 21:00 +0200
    Re: [kernel-hardening] [PATCH v3 1/3] x86/fpu: don't let userspace  set bogus xcomp_bv Rik van Riel <riel@redhat.com> - 2017-09-21 22:00 +0200
  [PATCH v3 2/3] x86/fpu: tighten validation of user-supplied xstate_header Eric Biggers <ebiggers3@gmail.com> - 2017-09-21 21:00 +0200
    Re: [kernel-hardening] [PATCH v3 2/3] x86/fpu: tighten validation  of user-supplied xstate_header Rik van Riel <riel@redhat.com> - 2017-09-21 22:30 +0200
  Re: [PATCH v3 0/3] x86/fpu: prevent leaking FPU registers via  invalid FPU state Ingo Molnar <mingo@kernel.org> - 2017-09-22 07:40 +0200
    Re: [PATCH v3 0/3] x86/fpu: prevent leaking FPU registers via  invalid FPU state Eric Biggers <ebiggers3@gmail.com> - 2017-09-22 19:10 +0200
      [PATCH] x86/fpu: Simplify fpu__activate_fpstate_read() Ingo Molnar <mingo@kernel.org> - 2017-09-23 12:20 +0200
        Re: [PATCH] x86/fpu: Simplify fpu__activate_fpstate_read() Ingo Molnar <mingo@kernel.org> - 2017-09-23 13:30 +0200
          Re: [PATCH] x86/fpu: Simplify fpu__activate_fpstate_read() Eric Biggers <ebiggers3@gmail.com> - 2017-09-23 20:30 +0200

csiph-web