From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 880BB3BA23A for ; Fri, 26 Jun 2026 20:23:39 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=170.10.129.124 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782505420; cv=none; b=Ci6GxY5dw/+Jr2lzwqDVQK3IAAXrD/AFnlJzNjJRXMGuS+G7qeUfSho/2WFNzki5fnNJxfhtAQiz69KE48MO1bhWbkF8PVmq4bIuRuwyKBjC0ECVpo/kV6NGxWUU4YRwo26KG3OwpyVwee9q3ukKceXP1vsu73HK3Y+fqMNL2P0= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782505420; c=relaxed/simple; bh=41r0BdOAOlgWCNX+HrdV2jUaEfQO1rV096GMQV3P0jE=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=ZqakTPXuyTld3uyfOQHh5Lj8jR6m7L0dDD0erR+THaZh5j+J/v9tC+6IjQ2saokWcgEF2U6WWXW5qeJXsvkWG/Q4C7ArohW2OE/0I4zZ9BHsx5KJF5wvXVhrJxQbSKo0Ob6Ee82avznZcOJ7iOWvDQ80Wwr29FBzMdliPiQCbGQ= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com; spf=pass smtp.mailfrom=redhat.com; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b=eom9sC+j; arc=none smtp.client-ip=170.10.129.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=redhat.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="eom9sC+j" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1782505418; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=x+r5ExsIUP7sm/0Z1QfY/QXFxeewV834xYOwEhE6q0U=; b=eom9sC+jS51DyEEeLmNjlP201ydZM8qBDNelFUehNpBAaj2x6HeUvoyso3RwvZXGzcsPcr BOy150x998PK+fKvLBWohLs8ybh3lfiTozhaZOzzd8qMzZguwwgrSDlaJXWDHaI3va5JJ8 J8IUZRQDmfobml33DR7kzSWOkA8KzGA= Received: from mx-prod-mc-08.mail-002.prod.us-west-2.aws.redhat.com (ec2-35-165-154-97.us-west-2.compute.amazonaws.com [35.165.154.97]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-537-Vl7kCkwRMb-9rkAQNcQjEQ-1; Fri, 26 Jun 2026 16:23:35 -0400 X-MC-Unique: Vl7kCkwRMb-9rkAQNcQjEQ-1 X-Mimecast-MFC-AGG-ID: Vl7kCkwRMb-9rkAQNcQjEQ_1782505413 Received: from mx-prod-int-08.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-08.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.111]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-08.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 6CD0B1805C25; Fri, 26 Jun 2026 20:23:33 +0000 (UTC) Received: from work.redhat.com (unknown [10.44.48.194]) by mx-prod-int-08.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id 22B21180028B; Fri, 26 Jun 2026 20:23:30 +0000 (UTC) From: Tim Wiederhake To: "H. Peter Anvin" , Thomas Gleixner , Ingo Molnar , Borislav Petkov , Dave Hansen , x86@kernel.org, linux-kernel@vger.kernel.org Cc: Tim Wiederhake Subject: [PATCH v2 2/2] x86/msr: Restrict /dev/cpu/*/msr read to a single MSR per call Date: Fri, 26 Jun 2026 22:23:22 +0200 Message-ID: <20260626202323.1169433-3-twiederh@redhat.com> In-Reply-To: <20260626174037.1128563-1-twiederh@redhat.com> References: <20260626174037.1128563-1-twiederh@redhat.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Scanned-By: MIMEDefang 3.4.1 on 10.30.177.111 Reading /dev/cpu/*/msr with a buffer larger than 8 bytes reads not successive MSRs, but the same one over and over. While documented, this behavior is unintuitive: A user space caller issuing a 16-byte read might reasonably expect to receive two consecutive MSRs rather than the same register twice. Remove the loop and process a single 8-byte MSR value per call to avoid this ambiguity. Signed-off-by: Tim Wiederhake --- arch/x86/kernel/msr.c | 21 +++++++-------------- 1 file changed, 7 insertions(+), 14 deletions(-) diff --git a/arch/x86/kernel/msr.c b/arch/x86/kernel/msr.c index cc719a6b2ba3..1ea7bd393072 100644 --- a/arch/x86/kernel/msr.c +++ b/arch/x86/kernel/msr.c @@ -60,24 +60,17 @@ static ssize_t msr_read(struct file *file, char __user *buf, u32 reg = *ppos; int cpu = iminor(file_inode(file)); int err = 0; - ssize_t bytes = 0; - if (count % 8) + if (count < 8) return -EINVAL; /* Invalid chunk size */ - for (; count; count -= 8) { - err = rdmsr_safe_on_cpu(cpu, reg, &data[0], &data[1]); - if (err) - break; - if (copy_to_user(tmp, &data, 8)) { - err = -EFAULT; - break; - } - tmp += 2; - bytes += 8; - } + err = rdmsr_safe_on_cpu(cpu, reg, &data[0], &data[1]); + if (err) + return err; + if (copy_to_user(tmp, &data, 8)) + return -EFAULT; - return bytes ? bytes : err; + return 8; } static int filter_write(u32 reg) -- 2.52.0