Messages in this thread | | | Date | Wed, 18 May 2022 13:14:40 +0200 | From | "Jason A. Donenfeld" <> | Subject | Re: [patch 0/3] x86/fpu: Prevent FPU state corruption |
| |
Hi Vadim,
On Wed, May 18, 2022 at 03:02:05AM +0200, Jason A. Donenfeld wrote: > Observation: the problem is definitely related to using the FPU in a > hard IRQ.
I wrote a tiny reproducer that should be pretty reliable for testing this, attached below. I think this proves my working theory. Run this in a VirtualBox VM, and then move your mouse around or hit the keyboard, or do something that triggers the add_{input,disk}_randomness() path from a hardirq handler. On my laptop, for example, the trackpoint goes via hardirq, but the touchpad does not. As soon as I move the trackpoint around, the below program prints "XSAVE is borked!".
Also, note that this isn't just "corruption" of the guest VM, but also leaking secret contents of the host VM into the guest. So you might really want to make sure VirtualBox issues a fix for this before 5.18, as it's arguably security sensitive.
Regards, Jason
#include <unistd.h> #include <stdio.h> #include <signal.h> #include <sys/wait.h> #include <sys/prctl.h>
int main(int argc, char *argv[]) { int status = 0;
for (int i = 0, nproc = sysconf(_SC_NPROCESSORS_ONLN); i < nproc; ++i) { if (!fork()) { prctl(PR_SET_PDEATHSIG, SIGKILL); asm("movq $42, %%rax\n" "movq %%rax, %%xmm0\n" "0:\n" "movq %%xmm0, %%rbx\n" "cmpq %%rax, %%rbx\n" "je 0b\n" : : : "rax", "rbx", "xmm0", "cc"); _exit(77); } } wait(&status); if (WEXITSTATUS(status) == 77) printf("XSAVE is borked!\n"); return 1; }
| |