Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1738139 > unrolled thread

[PATCH 00/10] x86/fpu: Split up "x86/fpu: Tighten validation of user-supplied xstate_header"

Started byIngo Molnar <mingo@kernel.org>
First post2017-09-24 13:00 +0200
Last post2017-09-24 21:10 +0200
Articles 8 on this page of 28 — 4 participants

Back to article view | Back to linux.kernel

Contents

  [PATCH 00/10] x86/fpu: Split up "x86/fpu: Tighten validation of user-supplied xstate_header" Ingo Molnar <mingo@kernel.org> - 2017-09-24 13:00 +0200
    [PATCH 02/10] x86/fpu: Use validate_xstate_header() to validate the xstate_header in xstateregs_set() Ingo Molnar <mingo@kernel.org> - 2017-09-24 13:00 +0200
      [tip:x86/fpu] x86/fpu: Use validate_xstate_header() to validate the  xstate_header in xstateregs_set() tip-bot for Eric Biggers <tipbot@zytor.com> - 2017-09-26 10:50 +0200
    [PATCH 09/10] x86/fpu: Use validate_xstate_header() to validate the xstate_header in copy_user_to_xstate() Ingo Molnar <mingo@kernel.org> - 2017-09-24 13:00 +0200
      [tip:x86/fpu] x86/fpu: Use validate_xstate_header() to validate the  xstate_header in copy_user_to_xstate() tip-bot for Eric Biggers <tipbot@zytor.com> - 2017-09-26 10:50 +0200
    [PATCH 10/10] x86/fpu: Use using_compacted_format() instead of open coded X86_FEATURE_XSAVES Ingo Molnar <mingo@kernel.org> - 2017-09-24 13:10 +0200
      [tip:x86/fpu] x86/fpu: Use using_compacted_format() instead of open  coded X86_FEATURE_XSAVES tip-bot for Eric Biggers <tipbot@zytor.com> - 2017-09-26 10:50 +0200
    [PATCH 03/10] x86/fpu: Use validate_xstate_header() to validate the xstate_header in sanitize_restored_xstate() Ingo Molnar <mingo@kernel.org> - 2017-09-24 13:10 +0200
      Re: [PATCH 03/10] x86/fpu: Use validate_xstate_header() to validate  the xstate_header in sanitize_restored_xstate() Eric Biggers <ebiggers3@gmail.com> - 2017-09-24 21:00 +0200
        Re: [PATCH 03/10] x86/fpu: Use validate_xstate_header() to validate  the xstate_header in sanitize_restored_xstate() Ingo Molnar <mingo@kernel.org> - 2017-09-24 21:10 +0200
          Re: [PATCH 03/10] x86/fpu: Use validate_xstate_header() to validate  the xstate_header in sanitize_restored_xstate() Eric Biggers <ebiggers3@gmail.com> - 2017-09-24 22:10 +0200
            Re: [PATCH 03/10] x86/fpu: Use validate_xstate_header() to validate  the xstate_header in sanitize_restored_xstate() Ingo Molnar <mingo@kernel.org> - 2017-09-25 08:10 +0200
            Re: [PATCH 03/10] x86/fpu: Use validate_xstate_header() to validate  the xstate_header in sanitize_restored_xstate() Ingo Molnar <mingo@kernel.org> - 2017-09-25 08:20 +0200
              Re: [PATCH 03/10] x86/fpu: Use validate_xstate_header() to validate  the xstate_header in sanitize_restored_xstate() Eric Biggers <ebiggers3@gmail.com> - 2017-09-25 09:30 +0200
                Re: [PATCH 03/10] x86/fpu: Use validate_xstate_header() to validate  the xstate_header in sanitize_restored_xstate() Ingo Molnar <mingo@kernel.org> - 2017-09-25 09:40 +0200
      [tip:x86/fpu] x86/fpu: Use validate_xstate_header() to validate the  xstate_header in __fpu__restore_sig() tip-bot for Eric Biggers <tipbot@zytor.com> - 2017-09-26 10:50 +0200
    [PATCH 07/10] x86/fpu: Copy the full header in copy_user_to_xstate() Ingo Molnar <mingo@kernel.org> - 2017-09-24 13:10 +0200
      [tip:x86/fpu] x86/fpu: Copy the full header in  copy_user_to_xstate() tip-bot for Eric Biggers <tipbot@zytor.com> - 2017-09-26 10:50 +0200
    [PATCH 01/10] x86/fpu: Introduce validate_xstate_header() Ingo Molnar <mingo@kernel.org> - 2017-09-24 13:10 +0200
      [tip:x86/fpu] x86/fpu: Introduce validate_xstate_header() tip-bot for Eric Biggers <tipbot@zytor.com> - 2017-09-26 10:50 +0200
    [PATCH 08/10] x86/fpu: Eliminate the 'xfeatures' local variable in copy_user_to_xstate() Ingo Molnar <mingo@kernel.org> - 2017-09-24 13:10 +0200
      [tip:x86/fpu] x86/fpu: Eliminate the 'xfeatures' local variable in  copy_user_to_xstate() tip-bot for Eric Biggers <tipbot@zytor.com> - 2017-09-26 10:50 +0200
    [PATCH 04/10] x86/fpu: Copy the full state_header in copy_kernel_to_xstate() Ingo Molnar <mingo@kernel.org> - 2017-09-24 13:10 +0200
      [tip:x86/fpu] x86/fpu: Copy the full state_header in  copy_kernel_to_xstate() tip-bot for Eric Biggers <tipbot@zytor.com> - 2017-09-26 10:50 +0200
    [PATCH 06/10] x86/fpu: Use validate_xstate_header() to validate the xstate_header in copy_kernel_to_xstate() Ingo Molnar <mingo@kernel.org> - 2017-09-24 13:10 +0200
      [tip:x86/fpu] x86/fpu: Use validate_xstate_header() to validate the  xstate_header in copy_kernel_to_xstate() tip-bot for Eric Biggers <tipbot@zytor.com> - 2017-09-26 10:50 +0200
    Re: [PATCH 00/10] x86/fpu: Split up "x86/fpu: Tighten validation of  user-supplied xstate_header" Linus Torvalds <torvalds@linux-foundation.org> - 2017-09-24 20:10 +0200
      Re: [PATCH 00/10] x86/fpu: Split up "x86/fpu: Tighten validation of  user-supplied xstate_header" Ingo Molnar <mingo@kernel.org> - 2017-09-24 21:10 +0200

Page 2 of 2 — ← Prev page 1 [2]

#1738149 — [PATCH 08/10] x86/fpu: Eliminate the 'xfeatures' local variable in copy_user_to_xstate()

FromIngo Molnar <mingo@kernel.org>
Date2017-09-24 13:10 +0200
Subject[PATCH 08/10] x86/fpu: Eliminate the 'xfeatures' local variable in copy_user_to_xstate()
Message-ID<utcXo-7Yz-17@gated-at.bofh.it>
In reply to#1738139
From: Eric Biggers <ebiggers@google.com>

We now have this field in hdr.xfeatures.

Signed-off-by: Eric Biggers <ebiggers@google.com>
Cc: Andy Lutomirski <luto@kernel.org>
Cc: Dave Hansen <dave.hansen@linux.intel.com>
Cc: Dmitry Vyukov <dvyukov@google.com>
Cc: Fenghua Yu <fenghua.yu@intel.com>
Cc: Kees Cook <keescook@chromium.org>
Cc: Kevin Hao <haokexin@gmail.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Michael Halcrow <mhalcrow@google.com>
Cc: Oleg Nesterov <oleg@redhat.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Rik van Riel <riel@redhat.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Wanpeng Li <wanpeng.li@hotmail.com>
Cc: Yu-cheng Yu <yu-cheng.yu@intel.com>
Cc: kernel-hardening@lists.openwall.com
Signed-off-by: Ingo Molnar <mingo@kernel.org>
---
 arch/x86/kernel/fpu/xstate.c | 11 ++++-------
 1 file changed, 4 insertions(+), 7 deletions(-)

diff --git a/arch/x86/kernel/fpu/xstate.c b/arch/x86/kernel/fpu/xstate.c
index 0cd7b73c25e8..b6d78b78b5c2 100644
--- a/arch/x86/kernel/fpu/xstate.c
+++ b/arch/x86/kernel/fpu/xstate.c
@@ -1197,7 +1197,6 @@ int copy_user_to_xstate(struct xregs_state *xsave, const void __user *ubuf)
 {
 	unsigned int offset, size;
 	int i;
-	u64 xfeatures;
 	u64 allowed_features;
 	struct xstate_header hdr;
 
@@ -1207,20 +1206,18 @@ int copy_user_to_xstate(struct xregs_state *xsave, const void __user *ubuf)
 	if (__copy_from_user(&hdr, ubuf + offset, size))
 		return -EFAULT;
 
-	xfeatures = hdr.xfeatures;
-
 	/*
 	 * Reject if the user sets any disabled or supervisor features:
 	 */
 	allowed_features = xfeatures_mask & ~XFEATURE_MASK_SUPERVISOR;
 
-	if (xfeatures & ~allowed_features)
+	if (hdr.xfeatures & ~allowed_features)
 		return -EINVAL;
 
 	for (i = 0; i < XFEATURE_MAX; i++) {
 		u64 mask = ((u64)1 << i);
 
-		if (xfeatures & mask) {
+		if (hdr.xfeatures & mask) {
 			void *dst = __raw_xsave_addr(xsave, 1 << i);
 
 			offset = xstate_offsets[i];
@@ -1231,7 +1228,7 @@ int copy_user_to_xstate(struct xregs_state *xsave, const void __user *ubuf)
 		}
 	}
 
-	if (xfeatures_mxcsr_quirk(xfeatures)) {
+	if (xfeatures_mxcsr_quirk(hdr.xfeatures)) {
 		offset = offsetof(struct fxregs_state, mxcsr);
 		size = MXCSR_AND_FLAGS_SIZE;
 		if (__copy_from_user(&xsave->i387.mxcsr, ubuf + offset, size))
@@ -1247,7 +1244,7 @@ int copy_user_to_xstate(struct xregs_state *xsave, const void __user *ubuf)
 	/*
 	 * Add back in the features that came in from userspace:
 	 */
-	xsave->header.xfeatures |= xfeatures;
+	xsave->header.xfeatures |= hdr.xfeatures;
 
 	return 0;
 }
-- 
2.11.0

[toc] | [prev] | [next] | [standalone]

#1739707 — [tip:x86/fpu] x86/fpu: Eliminate the 'xfeatures' local variable in copy_user_to_xstate()

Fromtip-bot for Eric Biggers <tipbot@zytor.com>
Date2017-09-26 10:50 +0200
Subject[tip:x86/fpu] x86/fpu: Eliminate the 'xfeatures' local variable in copy_user_to_xstate()
Message-ID<utTJ0-2nL-21@gated-at.bofh.it>
In reply to#1738149
Commit-ID:  3d703477bcfe8bb57079d97198cf1e342fe1fef9
Gitweb:     http://git.kernel.org/tip/3d703477bcfe8bb57079d97198cf1e342fe1fef9
Author:     Eric Biggers <ebiggers@google.com>
AuthorDate: Sun, 24 Sep 2017 12:59:11 +0200
Committer:  Ingo Molnar <mingo@kernel.org>
CommitDate: Tue, 26 Sep 2017 09:43:48 +0200

x86/fpu: Eliminate the 'xfeatures' local variable in copy_user_to_xstate()

We now have this field in hdr.xfeatures.

Signed-off-by: Eric Biggers <ebiggers@google.com>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Andy Lutomirski <luto@amacapital.net>
Cc: Andy Lutomirski <luto@kernel.org>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Dave Hansen <dave.hansen@linux.intel.com>
Cc: Dmitry Vyukov <dvyukov@google.com>
Cc: Eric Biggers <ebiggers3@gmail.com>
Cc: Fenghua Yu <fenghua.yu@intel.com>
Cc: Kees Cook <keescook@chromium.org>
Cc: Kevin Hao <haokexin@gmail.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Michael Halcrow <mhalcrow@google.com>
Cc: Oleg Nesterov <oleg@redhat.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Rik van Riel <riel@redhat.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Wanpeng Li <wanpeng.li@hotmail.com>
Cc: Yu-cheng Yu <yu-cheng.yu@intel.com>
Cc: kernel-hardening@lists.openwall.com
Link: http://lkml.kernel.org/r/20170924105913.9157-9-mingo@kernel.org
Signed-off-by: Ingo Molnar <mingo@kernel.org>
---
 arch/x86/kernel/fpu/xstate.c | 11 ++++-------
 1 file changed, 4 insertions(+), 7 deletions(-)

diff --git a/arch/x86/kernel/fpu/xstate.c b/arch/x86/kernel/fpu/xstate.c
index 0cd7b73..b6d78b7 100644
--- a/arch/x86/kernel/fpu/xstate.c
+++ b/arch/x86/kernel/fpu/xstate.c
@@ -1197,7 +1197,6 @@ int copy_user_to_xstate(struct xregs_state *xsave, const void __user *ubuf)
 {
 	unsigned int offset, size;
 	int i;
-	u64 xfeatures;
 	u64 allowed_features;
 	struct xstate_header hdr;
 
@@ -1207,20 +1206,18 @@ int copy_user_to_xstate(struct xregs_state *xsave, const void __user *ubuf)
 	if (__copy_from_user(&hdr, ubuf + offset, size))
 		return -EFAULT;
 
-	xfeatures = hdr.xfeatures;
-
 	/*
 	 * Reject if the user sets any disabled or supervisor features:
 	 */
 	allowed_features = xfeatures_mask & ~XFEATURE_MASK_SUPERVISOR;
 
-	if (xfeatures & ~allowed_features)
+	if (hdr.xfeatures & ~allowed_features)
 		return -EINVAL;
 
 	for (i = 0; i < XFEATURE_MAX; i++) {
 		u64 mask = ((u64)1 << i);
 
-		if (xfeatures & mask) {
+		if (hdr.xfeatures & mask) {
 			void *dst = __raw_xsave_addr(xsave, 1 << i);
 
 			offset = xstate_offsets[i];
@@ -1231,7 +1228,7 @@ int copy_user_to_xstate(struct xregs_state *xsave, const void __user *ubuf)
 		}
 	}
 
-	if (xfeatures_mxcsr_quirk(xfeatures)) {
+	if (xfeatures_mxcsr_quirk(hdr.xfeatures)) {
 		offset = offsetof(struct fxregs_state, mxcsr);
 		size = MXCSR_AND_FLAGS_SIZE;
 		if (__copy_from_user(&xsave->i387.mxcsr, ubuf + offset, size))
@@ -1247,7 +1244,7 @@ int copy_user_to_xstate(struct xregs_state *xsave, const void __user *ubuf)
 	/*
 	 * Add back in the features that came in from userspace:
 	 */
-	xsave->header.xfeatures |= xfeatures;
+	xsave->header.xfeatures |= hdr.xfeatures;
 
 	return 0;
 }

[toc] | [prev] | [next] | [standalone]

#1738151 — [PATCH 04/10] x86/fpu: Copy the full state_header in copy_kernel_to_xstate()

FromIngo Molnar <mingo@kernel.org>
Date2017-09-24 13:10 +0200
Subject[PATCH 04/10] x86/fpu: Copy the full state_header in copy_kernel_to_xstate()
Message-ID<utcXo-7Yz-19@gated-at.bofh.it>
In reply to#1738139
From: Eric Biggers <ebiggers@google.com>

This is in preparation to verify the full xstate header as supplied by user-space.

Signed-off-by: Eric Biggers <ebiggers@google.com>
Cc: Andy Lutomirski <luto@kernel.org>
Cc: Dave Hansen <dave.hansen@linux.intel.com>
Cc: Dmitry Vyukov <dvyukov@google.com>
Cc: Fenghua Yu <fenghua.yu@intel.com>
Cc: Kees Cook <keescook@chromium.org>
Cc: Kevin Hao <haokexin@gmail.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Michael Halcrow <mhalcrow@google.com>
Cc: Oleg Nesterov <oleg@redhat.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Rik van Riel <riel@redhat.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Wanpeng Li <wanpeng.li@hotmail.com>
Cc: Yu-cheng Yu <yu-cheng.yu@intel.com>
Cc: kernel-hardening@lists.openwall.com
Signed-off-by: Ingo Molnar <mingo@kernel.org>
---
 arch/x86/kernel/fpu/xstate.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/arch/x86/kernel/fpu/xstate.c b/arch/x86/kernel/fpu/xstate.c
index 2427aeea33b5..02591b96bb25 100644
--- a/arch/x86/kernel/fpu/xstate.c
+++ b/arch/x86/kernel/fpu/xstate.c
@@ -1148,11 +1148,13 @@ int copy_kernel_to_xstate(struct xregs_state *xsave, const void *kbuf)
 	int i;
 	u64 xfeatures;
 	u64 allowed_features;
+	struct xstate_header hdr;
 
 	offset = offsetof(struct xregs_state, header);
-	size = sizeof(xfeatures);
+	size = sizeof(hdr);
 
-	memcpy(&xfeatures, kbuf + offset, size);
+	memcpy(&hdr, kbuf + offset, size);
+	xfeatures = hdr.xfeatures;
 
 	/*
 	 * Reject if the user sets any disabled or supervisor features:
-- 
2.11.0

[toc] | [prev] | [next] | [standalone]

#1739712 — [tip:x86/fpu] x86/fpu: Copy the full state_header in copy_kernel_to_xstate()

Fromtip-bot for Eric Biggers <tipbot@zytor.com>
Date2017-09-26 10:50 +0200
Subject[tip:x86/fpu] x86/fpu: Copy the full state_header in copy_kernel_to_xstate()
Message-ID<utTJ1-2nL-35@gated-at.bofh.it>
In reply to#1738151
Commit-ID:  80d8ae86b36791a545ca28ddc95133ea59bba6e0
Gitweb:     http://git.kernel.org/tip/80d8ae86b36791a545ca28ddc95133ea59bba6e0
Author:     Eric Biggers <ebiggers@google.com>
AuthorDate: Sun, 24 Sep 2017 12:59:07 +0200
Committer:  Ingo Molnar <mingo@kernel.org>
CommitDate: Tue, 26 Sep 2017 09:43:46 +0200

x86/fpu: Copy the full state_header in copy_kernel_to_xstate()

This is in preparation to verify the full xstate header as supplied by user-space.

Signed-off-by: Eric Biggers <ebiggers@google.com>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Andy Lutomirski <luto@amacapital.net>
Cc: Andy Lutomirski <luto@kernel.org>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Dave Hansen <dave.hansen@linux.intel.com>
Cc: Dmitry Vyukov <dvyukov@google.com>
Cc: Eric Biggers <ebiggers3@gmail.com>
Cc: Fenghua Yu <fenghua.yu@intel.com>
Cc: Kees Cook <keescook@chromium.org>
Cc: Kevin Hao <haokexin@gmail.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Michael Halcrow <mhalcrow@google.com>
Cc: Oleg Nesterov <oleg@redhat.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Rik van Riel <riel@redhat.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Wanpeng Li <wanpeng.li@hotmail.com>
Cc: Yu-cheng Yu <yu-cheng.yu@intel.com>
Cc: kernel-hardening@lists.openwall.com
Link: http://lkml.kernel.org/r/20170924105913.9157-5-mingo@kernel.org
Signed-off-by: Ingo Molnar <mingo@kernel.org>
---
 arch/x86/kernel/fpu/xstate.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/arch/x86/kernel/fpu/xstate.c b/arch/x86/kernel/fpu/xstate.c
index 2427aee..02591b96 100644
--- a/arch/x86/kernel/fpu/xstate.c
+++ b/arch/x86/kernel/fpu/xstate.c
@@ -1148,11 +1148,13 @@ int copy_kernel_to_xstate(struct xregs_state *xsave, const void *kbuf)
 	int i;
 	u64 xfeatures;
 	u64 allowed_features;
+	struct xstate_header hdr;
 
 	offset = offsetof(struct xregs_state, header);
-	size = sizeof(xfeatures);
+	size = sizeof(hdr);
 
-	memcpy(&xfeatures, kbuf + offset, size);
+	memcpy(&hdr, kbuf + offset, size);
+	xfeatures = hdr.xfeatures;
 
 	/*
 	 * Reject if the user sets any disabled or supervisor features:

[toc] | [prev] | [next] | [standalone]

#1738155 — [PATCH 06/10] x86/fpu: Use validate_xstate_header() to validate the xstate_header in copy_kernel_to_xstate()

FromIngo Molnar <mingo@kernel.org>
Date2017-09-24 13:10 +0200
Subject[PATCH 06/10] x86/fpu: Use validate_xstate_header() to validate the xstate_header in copy_kernel_to_xstate()
Message-ID<utcXp-7Yz-35@gated-at.bofh.it>
In reply to#1738139
From: Eric Biggers <ebiggers@google.com>

Tighten the checks in copy_kernel_to_xstate().

Signed-off-by: Eric Biggers <ebiggers@google.com>
Cc: Andy Lutomirski <luto@kernel.org>
Cc: Dave Hansen <dave.hansen@linux.intel.com>
Cc: Dmitry Vyukov <dvyukov@google.com>
Cc: Fenghua Yu <fenghua.yu@intel.com>
Cc: Kees Cook <keescook@chromium.org>
Cc: Kevin Hao <haokexin@gmail.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Michael Halcrow <mhalcrow@google.com>
Cc: Oleg Nesterov <oleg@redhat.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Rik van Riel <riel@redhat.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Wanpeng Li <wanpeng.li@hotmail.com>
Cc: Yu-cheng Yu <yu-cheng.yu@intel.com>
Cc: kernel-hardening@lists.openwall.com
Signed-off-by: Ingo Molnar <mingo@kernel.org>
---
 arch/x86/kernel/fpu/xstate.c | 12 ++----------
 1 file changed, 2 insertions(+), 10 deletions(-)

diff --git a/arch/x86/kernel/fpu/xstate.c b/arch/x86/kernel/fpu/xstate.c
index c97c4a9db52a..325db7850335 100644
--- a/arch/x86/kernel/fpu/xstate.c
+++ b/arch/x86/kernel/fpu/xstate.c
@@ -1138,15 +1138,12 @@ int copy_xstate_to_user(void __user *ubuf, struct xregs_state *xsave, unsigned i
 
 /*
  * Convert from a ptrace standard-format kernel buffer to kernel XSAVES format
- * and copy to the target thread. This is called from xstateregs_set() and
- * there we check the CPU has XSAVES and a whole standard-sized buffer
- * exists.
+ * and copy to the target thread. This is called from xstateregs_set().
  */
 int copy_kernel_to_xstate(struct xregs_state *xsave, const void *kbuf)
 {
 	unsigned int offset, size;
 	int i;
-	u64 allowed_features;
 	struct xstate_header hdr;
 
 	offset = offsetof(struct xregs_state, header);
@@ -1154,12 +1151,7 @@ int copy_kernel_to_xstate(struct xregs_state *xsave, const void *kbuf)
 
 	memcpy(&hdr, kbuf + offset, size);
 
-	/*
-	 * Reject if the user sets any disabled or supervisor features:
-	 */
-	allowed_features = xfeatures_mask & ~XFEATURE_MASK_SUPERVISOR;
-
-	if (hdr.xfeatures & ~allowed_features)
+	if (validate_xstate_header(&hdr))
 		return -EINVAL;
 
 	for (i = 0; i < XFEATURE_MAX; i++) {
-- 
2.11.0

[toc] | [prev] | [next] | [standalone]

#1739701 — [tip:x86/fpu] x86/fpu: Use validate_xstate_header() to validate the xstate_header in copy_kernel_to_xstate()

Fromtip-bot for Eric Biggers <tipbot@zytor.com>
Date2017-09-26 10:50 +0200
Subject[tip:x86/fpu] x86/fpu: Use validate_xstate_header() to validate the xstate_header in copy_kernel_to_xstate()
Message-ID<utTIZ-2nL-11@gated-at.bofh.it>
In reply to#1738155
Commit-ID:  af95774b3ca080b0e1e651c0fc7680f3444ddda7
Gitweb:     http://git.kernel.org/tip/af95774b3ca080b0e1e651c0fc7680f3444ddda7
Author:     Eric Biggers <ebiggers@google.com>
AuthorDate: Sun, 24 Sep 2017 12:59:09 +0200
Committer:  Ingo Molnar <mingo@kernel.org>
CommitDate: Tue, 26 Sep 2017 09:43:47 +0200

x86/fpu: Use validate_xstate_header() to validate the xstate_header in copy_kernel_to_xstate()

Tighten the checks in copy_kernel_to_xstate().

Signed-off-by: Eric Biggers <ebiggers@google.com>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Andy Lutomirski <luto@amacapital.net>
Cc: Andy Lutomirski <luto@kernel.org>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Dave Hansen <dave.hansen@linux.intel.com>
Cc: Dmitry Vyukov <dvyukov@google.com>
Cc: Eric Biggers <ebiggers3@gmail.com>
Cc: Fenghua Yu <fenghua.yu@intel.com>
Cc: Kees Cook <keescook@chromium.org>
Cc: Kevin Hao <haokexin@gmail.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Michael Halcrow <mhalcrow@google.com>
Cc: Oleg Nesterov <oleg@redhat.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Rik van Riel <riel@redhat.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Wanpeng Li <wanpeng.li@hotmail.com>
Cc: Yu-cheng Yu <yu-cheng.yu@intel.com>
Cc: kernel-hardening@lists.openwall.com
Link: http://lkml.kernel.org/r/20170924105913.9157-7-mingo@kernel.org
Signed-off-by: Ingo Molnar <mingo@kernel.org>
---
 arch/x86/kernel/fpu/xstate.c | 12 ++----------
 1 file changed, 2 insertions(+), 10 deletions(-)

diff --git a/arch/x86/kernel/fpu/xstate.c b/arch/x86/kernel/fpu/xstate.c
index c97c4a9..325db78 100644
--- a/arch/x86/kernel/fpu/xstate.c
+++ b/arch/x86/kernel/fpu/xstate.c
@@ -1138,15 +1138,12 @@ int copy_xstate_to_user(void __user *ubuf, struct xregs_state *xsave, unsigned i
 
 /*
  * Convert from a ptrace standard-format kernel buffer to kernel XSAVES format
- * and copy to the target thread. This is called from xstateregs_set() and
- * there we check the CPU has XSAVES and a whole standard-sized buffer
- * exists.
+ * and copy to the target thread. This is called from xstateregs_set().
  */
 int copy_kernel_to_xstate(struct xregs_state *xsave, const void *kbuf)
 {
 	unsigned int offset, size;
 	int i;
-	u64 allowed_features;
 	struct xstate_header hdr;
 
 	offset = offsetof(struct xregs_state, header);
@@ -1154,12 +1151,7 @@ int copy_kernel_to_xstate(struct xregs_state *xsave, const void *kbuf)
 
 	memcpy(&hdr, kbuf + offset, size);
 
-	/*
-	 * Reject if the user sets any disabled or supervisor features:
-	 */
-	allowed_features = xfeatures_mask & ~XFEATURE_MASK_SUPERVISOR;
-
-	if (hdr.xfeatures & ~allowed_features)
+	if (validate_xstate_header(&hdr))
 		return -EINVAL;
 
 	for (i = 0; i < XFEATURE_MAX; i++) {

[toc] | [prev] | [next] | [standalone]

#1738247 — Re: [PATCH 00/10] x86/fpu: Split up "x86/fpu: Tighten validation of user-supplied xstate_header"

FromLinus Torvalds <torvalds@linux-foundation.org>
Date2017-09-24 20:10 +0200
SubjectRe: [PATCH 00/10] x86/fpu: Split up "x86/fpu: Tighten validation of user-supplied xstate_header"
Message-ID<utjvQ-3xk-17@gated-at.bofh.it>
In reply to#1738139
On Sun, Sep 24, 2017 at 3:59 AM, Ingo Molnar <mingo@kernel.org> wrote:
> As mentioned before, the patch was too big and too complex, and I've split it
> up into 10 smaller, bisectable patches:

Is this the (updated) stuff you want to send in for 4.14? Because I
like this smaller set more tor that than the big series I saw earlier.

I'm sure the bigger series is a better cleanup, but maybe we can wait
with that bigger change for 4.15?

             Linus

[toc] | [prev] | [next] | [standalone]

#1738253 — Re: [PATCH 00/10] x86/fpu: Split up "x86/fpu: Tighten validation of user-supplied xstate_header"

FromIngo Molnar <mingo@kernel.org>
Date2017-09-24 21:10 +0200
SubjectRe: [PATCH 00/10] x86/fpu: Split up "x86/fpu: Tighten validation of user-supplied xstate_header"
Message-ID<utkrU-46H-15@gated-at.bofh.it>
In reply to#1738247
* Linus Torvalds <torvalds@linux-foundation.org> wrote:

> On Sun, Sep 24, 2017 at 3:59 AM, Ingo Molnar <mingo@kernel.org> wrote:
> > As mentioned before, the patch was too big and too complex, and I've split it
> > up into 10 smaller, bisectable patches:
> 
> Is this the (updated) stuff you want to send in for 4.14? Because I
> like this smaller set more tor that than the big series I saw earlier.

It's a 10 patch split-up of one of the 34 patches from the bigger series :-/

> I'm sure the bigger series is a better cleanup, but maybe we can wait with that 
> bigger change for 4.15?

So all of this is pretty unfortunate timing, caused in part because I delayed the 
FPU changes in this merge window due to having so many x86 changes already.

I'd really love to have the bigger series, firstly because beyond the 
simplifications and the fixes in the 10-patch series it also fixes some other 
problems such as this SkyLake bug:

  0852b374173b: x86/fpu: Add FPU state copying quirk to handle XRSTOR failure on Intel Skylake CPUs

Secondly, with v4.14 being an LTS, doing the cleanups/simplifications afterwards 
adds a big backporting barrier.

But I can extract all the fixes and re-structure and re-test it all if you prefer 
it that way.

Thanks,

	Ingo

[toc] | [prev] | [standalone]

Page 2 of 2 — ← Prev page 1 [2]

Back to top | Article view | linux.kernel

csiph-web