Messages in this thread | | | Date | Thu, 13 Oct 2022 11:04:34 -0700 | Subject | Re: [PATCH] x86/fpu: Remove dynamic features from xcomp_bv for init_fpstate | From | Dave Hansen <> |
| |
On 10/12/22 20:35, Yao, Yuan wrote: > Below trace is observed on host kernel with this patch applied when create VM. > > The reason is __copy_xstate_to_uabi_buf() copies data from &init_fpstate when the component > is not existed in the source kernel fpstate (here is the AMX tile component), but the > AMX TILE bit is removed from init_fpstate due to this patch, so the WARN is triggered and return > NULL which causes kernel NULL pointer dereference later. > > I considered 2 possible ways to fix this without big change: > 1. For such non-exist component, we can fill the buffer in target fpstate to 0 and don't WARN if the bit is not set > in init_fpstate. > 2. Enlarge the init_fpstate to content the dynamic components and still keel fpu_kernel_cfg.max_features > in init_fpstate (but still remove the dynamic bit from new cloned thread), so we can use it safely in above case, > but near 2 pages (8K) is wasted.
There's a bigger problem here.
Removing the AMX bit from xstate_bv just *TELLS* the __raw_xsave_addr() about the buffer being too small. Before this patch, __raw_xsave_addr() was probably reading crap out of whatever is past 'init_fpstate' and copying it out to userspace.
This mess makes me want a guard page after 'init_fpstate'.
Anyway, this isn't really a separate bug. It's just more nasty fallout from xcomp_bv being wrong in the first place.
| |