lkml.org 
[lkml]   [2021]   [Jun]   [11]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
SubjectRe: [patch 06/41] x86/fpu: Sanitize xstateregs_set()
From
Date
On 6/11/21 9:15 AM, Thomas Gleixner wrote:
> xstateregs_set() operates on a stopped task and tries to copy the provided
> buffer into the tasks fpu.state.xsave buffer.
>
> Any error while copying or invalid state detected after copying results in
> wiping the target tasks FPU state completely including supervisor states.
>
> That's just wrong. The caller supplied invalid data or has a problem with
> unmapped memory, so there is absolutely no justification to corrupt the
> target state.
>
> @@ -1146,14 +1146,16 @@ int copy_kernel_to_xstate(struct xregs_s
> */
> xsave->header.xfeatures |= hdr.xfeatures;
>
> + /* mxcsr reserved bits must be masked to zero for security reasons. */
> + xsave->i387.mxcsr &= mxcsr_feature_mask;

This comment is vague. At least it should say:

A subsequent XRSTOR(S) will fail if MXCSR has bits set that are not
accepted by the current CPU. Mask out unsupported bits.

But a much nicer fix IMO would be to just return an error.

--Andy

\
 
 \ /
  Last update: 2021-06-11 20:46    [W:0.324 / U:0.312 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site