From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mgamail.intel.com (mgamail.intel.com [198.175.65.13]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A067C3955D2 for ; Tue, 30 Jun 2026 19:23:57 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=fail smtp.client-ip=198.175.65.13 ARC-Seal:i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782847438; cv=fail; b=VuFuHiwdAUX/HKE9w1ezN6eQJpmlJAIqXCzAXAXTL7rp0waWpU1cpC3ZwEkDOLdGmQIMQGN15rbkc9Tu6o2yE0Ypk9/5WCDnaRZvivrSR61vTVXoFB39NozqRGd8w7WX6R3LMZ2NX6sAo7Mu6dNnSl1Uy0D26jUYTbtwmrzvqvU= ARC-Message-Signature:i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782847438; c=relaxed/simple; bh=R8NJNUe+E1dBENvu/Ji4udUCm7NhEM1ggtZtqIWlvDo=; h=Message-ID:Date:Subject:To:CC:References:From:In-Reply-To: Content-Type:MIME-Version; b=FQ45F5jxJj3IvkRZkeGDKfJ75AOV8M7C/zyDWohQIXmL4viHAPCw8Er7QzngRr3QXpYL5KMlzLh0PT7i5A6AoBhpkkRTlgGxRYSAfVE0lKpyyYRpyPulS0A22sK+Umfo+IxjkaX795kBS+OOhiwNQPe3IOClX0hj9gj88J7xwBQ= ARC-Authentication-Results:i=2; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=intel.com; spf=pass smtp.mailfrom=intel.com; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b=O7/+df0T; arc=fail smtp.client-ip=198.175.65.13 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=intel.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=intel.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b="O7/+df0T" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1782847437; x=1814383437; h=message-id:date:subject:to:cc:references:from: in-reply-to:content-transfer-encoding:mime-version; bh=R8NJNUe+E1dBENvu/Ji4udUCm7NhEM1ggtZtqIWlvDo=; b=O7/+df0Tr6wuJGaZolUgBfiQJ3qRY713hjWFK85b84aujxqgzN6DkSCA cvLFdvthjcCxCASOJPuIzs1+6Ds4sKbXi8NYMid3pLkFl93TPEuckOSyF +fH7itcdG1b5QZJg7DbCE+8ErLS8ruy2+7qkQeyEIJnW8WIY55EeBNAoR RtW7SjaiEvW3t0g79GKLlit0jmTkpCW8PCYzs1We/M6CfbephmQYnWJwP VlLip6KdZPYCJBoAXEZtVEU622EWK5exh4u0os4vmPJilMuzrKgZm1vqx A6/ZrwZ+6Wb5667iKFaL5OiLWvqDfgG53kZ0swcujvBO+xA6kiHLD8RBi Q==; X-CSE-ConnectionGUID: 305uIo/TQQ6rL5ylp57jKQ== X-CSE-MsgGUID: XKBeBK9vSIqNIKN/5jNsdw== X-IronPort-AV: E=McAfee;i="6800,10657,11833"; a="94721878" X-IronPort-AV: E=Sophos;i="6.24,234,1774335600"; d="scan'208";a="94721878" Received: from fmviesa007.fm.intel.com ([10.60.135.147]) by orvoesa105.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 30 Jun 2026 12:23:57 -0700 X-CSE-ConnectionGUID: ztdVicN8TRiMntgOS0cDhQ== X-CSE-MsgGUID: rOThAo7HQ8CMCCkANJ1Tig== X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="6.24,234,1774335600"; d="scan'208";a="248986696" Received: from fmsmsx903.amr.corp.intel.com ([10.18.126.92]) by fmviesa007.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 30 Jun 2026 12:23:57 -0700 Received: from FMSMSX903.amr.corp.intel.com (10.18.126.92) by fmsmsx903.amr.corp.intel.com (10.18.126.92) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.43; Tue, 30 Jun 2026 12:23:56 -0700 Received: from fmsedg903.ED.cps.intel.com (10.1.192.145) by FMSMSX903.amr.corp.intel.com (10.18.126.92) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.43 via Frontend Transport; Tue, 30 Jun 2026 12:23:56 -0700 Received: from SJ2PR03CU001.outbound.protection.outlook.com (52.101.43.27) by edgegateway.intel.com (192.55.55.83) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.43; Tue, 30 Jun 2026 12:23:56 -0700 ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=UTLSYeZ16QSYcLEY1GEgWGfBTPI4Yojjp3dFgOY11gC+dHi7D83Q1YAmXRz4DtKrkW/6tyyp1CrfEga4v3nyGznUmQQadsErDIfxi8aIpUXst0qJARHDms41ybe9QzE9R2jF+AIApFdNUXIccsvtio3gcez26qUIPtr0jnOLJWEWE36pvjy+BAeK7GKQclvs34XWTnDd1KFs7W8dQO2JzO4syT9USAaFu6mehTCJAyL+KTyVW41LKXbPPP5iyCOlNxr8O9tc+vF5lwjLf9zgej4eSqZISerhkh6/X6m9rRXcJZa4yJsxiZtd49RTG5Bwn0gzyTwZw6VVBpsuyk7drQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=cSNgaEWiwfucG+AXf4lSpD2cX/TFewCdgopue+AWW98=; b=bymeQU4U/fgUsP+hvYLWiD4pHTkAArDxxSfMIHtMsSWv60e+87g8QeIVtVaRVFh6HCdU0IzKThocJaQQqox4sjfh5PT54kf3nLYQ6Sdt4wt6qDpCJmAjeOL45ITNPZuiXhhL8qFybtfzcAWRhqVD3pFIMpW8JnXZfOGpFxElWYo1bqYMMwK/oGSwc8b2QNKjfrYKlDnKBsSvkCKM0eXpcmdDmsBR02KGott6YqPWqNlyWrb3bRvIRxJRIFf7Jx+XHkRFZqhE3VPgQPp9kQ2aO6clr948xdJIb33Lx5me12PA7SkvtRmYPBRSoQ9mAD/aEUa1Im7bER0DZJF8TGy4hQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=intel.com; dmarc=pass action=none header.from=intel.com; dkim=pass header.d=intel.com; arc=none Authentication-Results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=intel.com; Received: from DS0PR11MB7925.namprd11.prod.outlook.com (2603:10b6:8:f8::18) by PH0PR11MB4886.namprd11.prod.outlook.com (2603:10b6:510:33::22) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.159.16; Tue, 30 Jun 2026 19:23:54 +0000 Received: from DS0PR11MB7925.namprd11.prod.outlook.com ([fe80::60af:89a0:65dc:9c84]) by DS0PR11MB7925.namprd11.prod.outlook.com ([fe80::60af:89a0:65dc:9c84%3]) with mapi id 15.21.0159.018; Tue, 30 Jun 2026 19:23:54 +0000 Message-ID: <4b76762c-387e-4f26-8e0f-155802b13bce@intel.com> Date: Tue, 30 Jun 2026 12:23:51 -0700 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH 05/10] x86/fpu: Fix potential underflow in xstate_calculate_size() To: Andrei Vagin , Thomas Gleixner , "Ingo Molnar" , Borislav Petkov CC: , , Dave Hansen , , "H. Peter Anvin" References: <20260615193716.1843340-1-avagin@google.com> <20260615193716.1843340-6-avagin@google.com> Content-Language: en-US From: "Chang S. Bae" In-Reply-To: <20260615193716.1843340-6-avagin@google.com> Content-Type: text/plain; charset="UTF-8"; format=flowed Content-Transfer-Encoding: 7bit X-ClientProxiedBy: BY3PR04CA0006.namprd04.prod.outlook.com (2603:10b6:a03:217::11) To DS0PR11MB7925.namprd11.prod.outlook.com (2603:10b6:8:f8::18) Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: DS0PR11MB7925:EE_|PH0PR11MB4886:EE_ X-MS-Office365-Filtering-Correlation-Id: 6f470fb9-963e-4793-61d3-08ded6dd1fdf X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|376014|23010399003|366016|1800799024|4143699003|11063799006|56012099006|18002099003|22082099003; X-Microsoft-Antispam-Message-Info: zLSZLUO1VB2hfBpI/G1UM9L+4PAgFlkYyDTqSEEBTGVKoZGDxVqRVB+pZfnxYSGyz/NeNCFZizJXbnGpkkqAb+ENq2byd43yzfiL3omx+XaQw5zTpUd2hke3t0EfLuijuGzq4amikxearSWrYUagbKctuuJKNqUCweck/GE3j0pjESEdZXtBXPZBca7y6qW/h2JfKxqw0AUMSS7x5TZWrTDgQsNMxh6OfAWdo4CI+np3Fqbi5PNMsEMHCufGyMjAyBnNyiueAOlEnafr8HF2LViaOKzIrQ4KOTBHBO17dJyRoBT3byBgTgByLMOvsjQYgYPhnpu9C2k0+PMstLto4LNoIPdlrjLJqrSJaUmLpDY3hnzTFiYW8itHyO0aBp1rlldBsW5/Ul2SYkO8/QvoJBC/FbHfjC9n8Q1eUQO7escTVUKt2Mct3W9NV63XhLFTIVkzaz0E1bVILTWO6t6t1uynSJX+TiMXDZE8ZvS9MkxCEqss9nBrlAJA+xeQ+LAFeDHN9mAV08DzO7z08XePK7rVlaFPKl+zpT+kp37EkCPDgBu/6SycrXVbdIdOqNBVi4eokfncsIkvA3Kdf18Rpmq6EG/x1596qhzDCnEmeT5u28xkBjXMoGkW9SpB2Kjsd5pUe8g0ijAemzx7+zAfIEyuBrX2mZah1fUrCz+K3NI= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:DS0PR11MB7925.namprd11.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(376014)(23010399003)(366016)(1800799024)(4143699003)(11063799006)(56012099006)(18002099003)(22082099003);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?utf-8?B?aWpwQzczdVVLQThnTmVRQkN1WjhCeFU3dDlFeWlDMWVYV1AyMDYwSDhYalNW?= =?utf-8?B?VHprMXlLZzErT09DN1IwUFo1Tmdya3VHQzlGdEg1QnRCK2hVeTZEM0tLclgw?= =?utf-8?B?RmhqUXhCSWppNTlrMWJNV0dKWTJzcDk0Vng2a2duelhjaDA0aGdvUGxlSEJ0?= =?utf-8?B?dytobVM4aFM5R09tUUFsSWZaQklBRkR0SkxmZHVwem5kTHRGWFBFK3pWWExU?= =?utf-8?B?U3dKWmg0dVhFZHNnVnJaeGJOUk14U1pSZWtWNmhsMXdLSVgwYU9FRCtBbVRC?= =?utf-8?B?eTdMSnM1ZmFUQ1c4ejhON1MzRDRqRDhRZ1ZsbTZzbUVMRWtHaHcwY25CTEQ4?= =?utf-8?B?WDdyZ0RvZTlXUzlDL3VaeGU3QUhEYzh3UlpuMXdUSU9BelVqbXZBcitrN1kz?= =?utf-8?B?NHV5c0dKWTJvYmtmR3FSNk9BUDhoa3ZiWmM3Nmt5bS85QXh2MEFIZ1dMVUov?= =?utf-8?B?UHdvQk5EemlnUldWdEpaa3dYZDg2cFRGdENQL3hzTW1PeFJadWFpeVcyRGp3?= =?utf-8?B?ZUNYSk02eFdJMmpickRKWThwT1F2ZncreWwzeGFjMSt1WUloSUc3eUZlKyts?= =?utf-8?B?Zko3RGxFeTlLQzd3M3RTQjZiQzZuOURkYmtmRm1LMzRDaGwwdVliS3ZNSE5I?= =?utf-8?B?U1J6SDlYcWgrWW1aK0lnL1liV0Q4Szh5VEF5L2FIMG5kcktIamF1NncrRmt3?= =?utf-8?B?VE01OXlOaHhuQWcwbE9VRmVZY3FYOXhNemZ2Q1V6TmhlenMzdS9CbGc2cWdx?= =?utf-8?B?dHRKdElacW5sMzArbUIrRmVWeVFCaVFKTW1CMjJSRHFlWmtjOUJsc001bk5m?= =?utf-8?B?cDFoV2ptaWt0WmZBUnNnYmV2NlBzU0NVdmt2VmdqYjhBNWs0eGZSLzArcnB0?= =?utf-8?B?QmxkMXk4dTFZaFVLbTY2Ym1sR3REb3o4YlFmZnBUWVFtaGhNb1gyWXdEWm10?= =?utf-8?B?UHY5VGY4Q0ZHTGRHOHVEZStDMlNPdEgzbXp2R2tCU2c3cFlRY2pPOWxLQ1JQ?= =?utf-8?B?SUZSdTJSemNlek5DcDRZZjZ6T2VvNXZLRlByWng2V1JuK1hSNUNqUFdYRGVs?= =?utf-8?B?ZzVMQ3BUNHJabkpvN1RjZXRPUng2aHRoYjQzY0RzOVZ5WkppRFFJME9jN2p1?= =?utf-8?B?OUpVdEVBOHhCQVBHVGZOMFVYT1h3bHFhQU9TS016KysrMjJ5ZHJONEhDVEdP?= =?utf-8?B?aG9rdmJqK252VGJXVXdaVS9SK1Fxb2VjSDJEaTNXTXJsenJHcG90bUplNGo4?= =?utf-8?B?ZEJEZGh2S0ZmS1QrK2RRcnhuSit1YkRMbHJ2T00xcXZxcURtdU1FTzViR00z?= =?utf-8?B?emFUdjFTckhlYnZPYzRsbVI2bWVrcE9odEZNanFOMTZYc1U2WEI4OStPT09C?= =?utf-8?B?cGdlUUE4ZncyNSt0TDNES1UzYWR3V21OVHJROExMMEVVUllCL1Zoc2xTZXdy?= =?utf-8?B?K2tZdXcwQmsxbFV6Q3VSKzZiTzViUm02cVBWaEx2MktsNDlmc1NqOFVKbjFj?= =?utf-8?B?ZzFac3d5OWJmdkNBb0dwWVd3KzYzdGtpaWREUE9LM3JCWDVvUjAwK0dwWHZX?= =?utf-8?B?MlErZlBrTElmRHF0dFNiL0MzWHBaUHNvK1U2RTRwY1dPL0NKZGNoejh3aVdE?= =?utf-8?B?bTh6Tk5DNDlFRkVUSG50SnVHdFdwMlFJSkllMWNNQzlBNkVvcTRRdEhuYWp4?= =?utf-8?B?UjZVdnpINFZwbGROaXc2QVRmYmFDVm5OeHlibk42UFQ3Y0xpMEZ6cWVjTWE3?= =?utf-8?B?b1RsV2JiK3hmSVppUUc4NDhHbm0xYmwwNWttRW9pdktFdEtkRWFEUFoyT1Bv?= =?utf-8?B?TTdGcWhaWk9ySlRtbmJtbXZRUXVTZTdhblQ4MUx2OGU0NUhiekFSSGV6NW9N?= =?utf-8?B?V3pWbGl2M1Jxb0NMNUUwYlViTitJOEsyc0c1dUc1YmNxb2FSSzR1U2YyTjY4?= =?utf-8?B?RnFGR0c1S21xcXdMMEJyZk9DUFRjbkVYUXdBOUtDdFdsU1p5Mnd4ZVk1cEpH?= =?utf-8?B?c0ZoVlM0dGJkeTVnbXBPa3hUVzg4cC9NYUJKaWJtQmRaYVlvbUoyNzlNL28v?= =?utf-8?B?V0lFUFZpRUhwdHRWdWhGTWUwNjFKNjRhaHdMcVZpWnRkUlRFUW42b2lud1Z0?= =?utf-8?B?RlkxMlovcEtlWnMvYlFhUlJkdERPdUtqZjRUajhTSG9KZWtJY1dBamZGUkFm?= =?utf-8?B?WTZQekQzVzErc0h1ZDZIZ3NPUzU0RXFsb1V2THBIVjNGYzBLaWdleGl1UHRr?= =?utf-8?B?YUk4S3YvTFdsN3pyT3lpMEsyMEFzSkFlM3VxcUpHWlZIbVZHa3pSS3NLQ1M2?= =?utf-8?B?amxvd1luWVVIWDUxTkd3TnlqanErVjN4MGd5NnhUWnZuRGFodHpGQT09?= X-Exchange-RoutingPolicyChecked: UJk+ube4qE212j9mXcHBUhMzUAu+8dPc5lY3YZBBisW/23oaKYxSf/4O3u+I3Kc+BLGLSdOqmCy/PaB2GDAY94U0IXWYwwFz7GuY0lGwAQFqI+K/LSdpEferMtfol1LsJQs/cZIt6Nm+l7l+yPr6zZ3D3qy19NxUIJX+08+MZL8Qsk2VUU1yj32Mwscf+3yIoO+HLYd/WElcOVvAxwbrw5YCUzvJ9EKZZyNT1jZKrX0sE9pxkMd9t2VV2jtOWTqcXE1f3rCDlWLPuuEJ8XRDP/P1QgabCStOkLS0KZSE16poIkilxcs9x6PjqVvDq93HIuvbbkT7vZWWkSWmRdXxKg== X-MS-Exchange-CrossTenant-Network-Message-Id: 6f470fb9-963e-4793-61d3-08ded6dd1fdf X-MS-Exchange-CrossTenant-AuthSource: DS0PR11MB7925.namprd11.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 30 Jun 2026 19:23:54.7729 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 46c98d88-e344-4ed4-8496-4ed7712e255d X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: KX8ZZ+ll0RZ4TlRWH8O36pXOyr8pzG5Lazbk97nVhohT8gBeM2Oh9jGSGRbzKPX62M25wNKtYtChzJWiDWppdYJZVgT7qUQ3cTCU05H2gJI= X-MS-Exchange-Transport-CrossTenantHeadersStamped: PH0PR11MB4886 X-OriginatorOrg: intel.com On 6/15/2026 12:37 PM, Andrei Vagin wrote: > xstate_calculate_size() calculates the size required for a given set of > xfeatures. It determines the topmost feature by finding the most > significant bit in xfeatures using fls64(xfeatures) - 1. > > If xfeatures is 0, fls64(0) returns 0, and topmost becomes -1. > Previously, topmost was unsigned int, so -1 underflowed to UINT_MAX. > This caused the subsequent check `topmost <= XFEATURE_SSE` to fail, and > the code proceeded to access xstate arrays using topmost (UINT_MAX) as > an index, leading to an out-of-bounds access. > > Fix this by checking if xfeatures only contains legacy features (FP/SSE) > or is empty (xfeatures <= XFEATURE_MASK_FPSSE) before calculating > topmost. Just a nit: this appears to prepare for the changes in patch7. If so, it may make sense to move it just before that?