lkml.org 
[lkml]   [2022]   [Oct]   [13]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
SubjectRe: [PATCH] x86/fpu: Remove dynamic features from xcomp_bv for init_fpstate
From
On 10/12/22 20:35, Yao, Yuan wrote:
> Below trace is observed on host kernel with this patch applied when create VM.
>
> The reason is __copy_xstate_to_uabi_buf() copies data from &init_fpstate when the component
> is not existed in the source kernel fpstate (here is the AMX tile component), but the
> AMX TILE bit is removed from init_fpstate due to this patch, so the WARN is triggered and return
> NULL which causes kernel NULL pointer dereference later.
>
> I considered 2 possible ways to fix this without big change:
> 1. For such non-exist component, we can fill the buffer in target fpstate to 0 and don't WARN if the bit is not set
> in init_fpstate.
> 2. Enlarge the init_fpstate to content the dynamic components and still keel fpu_kernel_cfg.max_features
> in init_fpstate (but still remove the dynamic bit from new cloned thread), so we can use it safely in above case,
> but near 2 pages (8K) is wasted.

There's a bigger problem here.

Removing the AMX bit from xstate_bv just *TELLS* the __raw_xsave_addr()
about the buffer being too small. Before this patch, __raw_xsave_addr()
was probably reading crap out of whatever is past 'init_fpstate' and
copying it out to userspace.

This mess makes me want a guard page after 'init_fpstate'.

Anyway, this isn't really a separate bug. It's just more nasty fallout
from xcomp_bv being wrong in the first place.

\
 
 \ /
  Last update: 2022-10-13 21:39    [W:0.222 / U:0.228 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site