| Date | Fri, 11 Jun 2021 20:15:18 +0200 | From | Borislav Petkov <> | Subject | Re: [patch 05/41] x86/fpu: Limit xstate copy size in xstateregs_set() |
| |
On Fri, Jun 11, 2021 at 06:15:28PM +0200, Thomas Gleixner wrote: > If the count argument is larger than the xstate size, this will happily > copy beyond the end of xstate. > > Fixes: 91c3dba7dbc1 ("x86/fpu/xstate: Fix PTRACE frames for XSAVES") > Signed-off-by: Thomas Gleixner <tglx@linutronix.de> > --- > arch/x86/kernel/fpu/regset.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > --- a/arch/x86/kernel/fpu/regset.c > +++ b/arch/x86/kernel/fpu/regset.c > @@ -117,7 +117,7 @@ int xstateregs_set(struct task_struct *t > /* > * A whole standard-format XSAVE buffer is needed: > */ > - if ((pos != 0) || (count < fpu_user_xstate_size)) > + if (pos != 0 || count != fpu_user_xstate_size) > return -EFAULT; > > xsave = &fpu->state.xsave;
Patches 3-5:
Reviewed-by: Borislav Petkov <bp@suse.de>
-- Regards/Gruss, Boris.
SUSE Software Solutions Germany GmbH, GF: Felix Imendörffer, HRB 36809, AG Nürnberg
|