lkml.org 
[lkml]   [2020]   [May]   [7]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
From
Subject[PATCH] x86/fpu/xstate: Clear uninitialized xstate areas in core dump
Date
In a core dump, copy_xstate_to_kernel() copies only enabled user xfeatures
to a kernel buffer without touching areas for disabled xfeatures. However,
those uninitialized areas may contain random data, which is then written to
the core dump file and can be read by a non-privileged user.

Fix it by clearing uninitialized areas.

Link: https://github.com/google/kmsan/issues/76
Link: https://lore.kernel.org/lkml/20200419100848.63472-1-glider@google.com/
Signed-off-by: Yu-cheng Yu <yu-cheng.yu@intel.com>
Reported-by: sam <sunhaoyl@outlook.com>
Cc: "H. Peter Anvin" <hpa@zytor.com>
Cc: Kees Cook <keescook@chromium.org>
Cc: Alexey Dobriyan <adobriyan@gmail.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Dave Hansen <dave.hansen@intel.com>
Cc: Jann Horn <jannh@google.com>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Alexander Potapenko <glider@google.com>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: <stable@vger.kernel.org>
---
arch/x86/kernel/fpu/xstate.c | 16 ++++++++++++++++
1 file changed, 16 insertions(+)

diff --git a/arch/x86/kernel/fpu/xstate.c b/arch/x86/kernel/fpu/xstate.c
index 32b153d38748..0856daa29be7 100644
--- a/arch/x86/kernel/fpu/xstate.c
+++ b/arch/x86/kernel/fpu/xstate.c
@@ -983,6 +983,7 @@ int copy_xstate_to_kernel(void *kbuf, struct xregs_state *xsave, unsigned int of
{
unsigned int offset, size;
struct xstate_header header;
+ int last_off;
int i;

/*
@@ -1006,7 +1007,17 @@ int copy_xstate_to_kernel(void *kbuf, struct xregs_state *xsave, unsigned int of

__copy_xstate_to_kernel(kbuf, &header, offset, size, size_total);

+ last_off = 0;
+
for (i = 0; i < XFEATURE_MAX; i++) {
+ /*
+ * Clear uninitialized area before XSAVE header.
+ */
+ if (i == FIRST_EXTENDED_XFEATURE) {
+ memset(kbuf + last_off, 0, XSAVE_HDR_OFFSET - last_off);
+ last_off = XSAVE_HDR_OFFSET + XSAVE_HDR_SIZE;
+ }
+
/*
* Copy only in-use xstates:
*/
@@ -1020,11 +1031,16 @@ int copy_xstate_to_kernel(void *kbuf, struct xregs_state *xsave, unsigned int of
if (offset + size > size_total)
break;

+ memset(kbuf + last_off, 0, offset - last_off);
+ last_off = offset + size;
+
__copy_xstate_to_kernel(kbuf, src, offset, size, size_total);
}

}

+ memset(kbuf + last_off, 0, size_total - last_off);
+
if (xfeatures_mxcsr_quirk(header.xfeatures)) {
offset = offsetof(struct fxregs_state, mxcsr);
size = MXCSR_AND_FLAGS_SIZE;
--
2.21.0
\
 
 \ /
  Last update: 2020-05-07 18:50    [W:0.048 / U:0.700 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site