Messages in this thread | | | Date | Wed, 2 Jun 2021 19:44:53 +0200 | From | Borislav Petkov <> | Subject | Re: [patch 4/8] x86/fpu: Limit xstate copy size in xstateregs_set() |
| |
On Wed, Jun 02, 2021 at 11:55:47AM +0200, Thomas Gleixner wrote: > If the count argument is larger than the xstate size, this will happily > copy beyond the end of xstate. > > Fixes: 91c3dba7dbc1 ("x86/fpu/xstate: Fix PTRACE frames for XSAVES") > Signed-off-by: Thomas Gleixner <tglx@linutronix.de> > Cc: stable@vger.kernel.org > --- > arch/x86/kernel/fpu/regset.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > --- a/arch/x86/kernel/fpu/regset.c > +++ b/arch/x86/kernel/fpu/regset.c > @@ -117,7 +117,7 @@ int xstateregs_set(struct task_struct *t > /* > * A whole standard-format XSAVE buffer is needed: > */ > - if ((pos != 0) || (count < fpu_user_xstate_size)) > + if (pos != 0 || count != fpu_user_xstate_size) > return -EFAULT; > > xsave = &fpu->state.xsave;
Looking at this one, I guess it and all the CC:stable ones should be at the beginning of the set so that they go to Linus now...
-- Regards/Gruss, Boris.
https://people.kernel.org/tglx/notes-about-netiquette
| |