From: "Yu, Yu-cheng" <yu-cheng.yu@intel.com>
To: Thomas Gleixner <tglx@linutronix.de>,
LKML <linux-kernel@vger.kernel.org>
Cc: x86@kernel.org, Andy Lutomirski <luto@kernel.org>,
Dave Hansen <dave.hansen@linux.intel.com>,
Fenghua Yu <fenghua.yu@intel.com>,
Tony Luck <tony.luck@intel.com>
Subject: Re: [patch 0/8] x86/fpu: Mop up XSAVES and related damage
Date: Wed, 2 Jun 2021 14:28:00 -0700 [thread overview]
Message-ID: <9c5c90bf-fbf6-7e45-4668-2f40f11e8b36@intel.com> (raw)
In-Reply-To: <20210602095543.149814064@linutronix.de>
On 6/2/2021 2:55 AM, Thomas Gleixner wrote:
> syszbot reported a warnon for XRSTOR raising #GP:
>
> https://lore.kernel.org/r/0000000000004c453905c30f8334@google.com
>
> with a syzcaller reproducer and a conclusive bisect result.
>
> It took a while to destill a simple C reproducer out of it which allowed to
> pin point the root cause: The recent addition of supervisor XSTATEs broke
> the signal restore path for the case where the signal handler wreckaged the
> XSTATE on stack because it does not sanitize the XSTATE header which causes
> a subsequent XRSTOR to fail and #GP.
>
> The following series addresses the problem and fixes related issues which
> were found while inspecting the related changes.
>
> Thanks to Andy and Dave for working on this with me!
>
> Thanks,
>
> tglx
> ---
> arch/x86/include/asm/fpu/xstate.h | 4
> arch/x86/kernel/fpu/core.c | 62 ++++++---
> arch/x86/kernel/fpu/regset.c | 43 ++----
> arch/x86/kernel/fpu/signal.c | 30 +++-
> arch/x86/kernel/fpu/xstate.c | 95 +++++----------
> b/tools/testing/selftests/x86/corrupt_xstate_header.c | 114 ++++++++++++++++++
> tools/testing/selftests/x86/Makefile | 3
> 7 files changed, 234 insertions(+), 117 deletions(-)
>
With the series applied, glibc pkey test fails sometimes. I will try to
find out the cause.
The test:
https://sourceware.org/git/?p=glibc.git;a=blob;f=sysdeps/unix/sysv/linux/tst-pkey.c
The output:
error: ../sysdeps/unix/sysv/linux/tst-pkey.c:161: not true:
!check_page_access (i, false)
error: ../sysdeps/unix/sysv/linux/tst-pkey.c:162: not true:
!check_page_access (i, true)
error: ../sysdeps/unix/sysv/linux/tst-pkey.c:161: not true:
!check_page_access (i, false)
error: ../sysdeps/unix/sysv/linux/tst-pkey.c:162: not true:
!check_page_access (i, true)
error: ../sysdeps/unix/sysv/linux/tst-pkey.c:161: not true:
!check_page_access (i, false)
error: ../sysdeps/unix/sysv/linux/tst-pkey.c:162: not true:
!check_page_access (i, true)
../sysdeps/unix/sysv/linux/tst-pkey.c:238: numeric comparison failure
left: 0 (0x0); from: result->access_rights[i]
right: 1 (0x1); from: PKEY_DISABLE_ACCESS
../sysdeps/unix/sysv/linux/tst-pkey.c:238: numeric comparison failure
left: 0 (0x0); from: result->access_rights[i]
right: 1 (0x1); from: PKEY_DISABLE_ACCESS
../sysdeps/unix/sysv/linux/tst-pkey.c:238: numeric comparison failure
left: 0 (0x0); from: result->access_rights[i]
right: 1 (0x1); from: PKEY_DISABLE_ACCESS
../sysdeps/unix/sysv/linux/tst-pkey.c:242: numeric comparison failure
left: 0 (0x0); from: result->access_rights[i]
right: 1 (0x1); from: PKEY_DISABLE_ACCESS
../sysdeps/unix/sysv/linux/tst-pkey.c:242: numeric comparison failure
left: 0 (0x0); from: result->access_rights[i]
right: 1 (0x1); from: PKEY_DISABLE_ACCESS
../sysdeps/unix/sysv/linux/tst-pkey.c:242: numeric comparison failure
left: 0 (0x0); from: result->access_rights[i]
right: 1 (0x1); from: PKEY_DISABLE_ACCESS
error: 12 test failures
next prev parent reply other threads:[~2021-06-02 21:28 UTC|newest]
Thread overview: 33+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-06-02 9:55 Thomas Gleixner
2021-06-02 9:55 ` [patch 1/8] selftests/x86: Test signal frame XSTATE header corruption handling Thomas Gleixner
2021-06-02 12:38 ` Borislav Petkov
2021-06-02 14:15 ` Thomas Gleixner
2021-06-03 13:16 ` Shuah Khan
2021-06-02 15:59 ` [patch V2 " Thomas Gleixner
2021-06-02 16:02 ` [patch V2a " Thomas Gleixner
2021-06-02 9:55 ` [patch 2/8] x86/fpu: Prevent state corruption in __fpu__restore_sig() Thomas Gleixner
2021-06-02 13:12 ` Borislav Petkov
2021-06-02 14:46 ` Thomas Gleixner
2021-06-02 15:58 ` [patch V2 " Thomas Gleixner
2021-06-02 9:55 ` [patch 3/8] x86/fpu: Invalidate FPU state after a failed XRSTOR from a user buffer Thomas Gleixner
2021-06-02 15:06 ` Borislav Petkov
2021-06-03 17:30 ` Andy Lutomirski
2021-06-03 19:28 ` Borislav Petkov
2021-06-02 9:55 ` [patch 4/8] x86/fpu: Limit xstate copy size in xstateregs_set() Thomas Gleixner
2021-06-02 17:44 ` Borislav Petkov
2021-06-02 9:55 ` [patch 5/8] x86/fpu: Sanitize xstateregs_set() Thomas Gleixner
2021-06-02 16:01 ` [patch V2 " Thomas Gleixner
2021-06-03 11:32 ` Borislav Petkov
2021-06-03 17:24 ` [patch " Andy Lutomirski
2021-06-02 9:55 ` [patch 6/8] x86/fpu: Add address range checks to copy_user_to_xstate() Thomas Gleixner
2021-06-02 9:55 ` [patch 7/8] x86/fpu: Clean up the fpu__clear() variants Thomas Gleixner
2021-06-02 9:55 ` [patch 8/8] x86/fpu: Deduplicate copy_xxx_to_xstate() Thomas Gleixner
2021-06-03 16:56 ` Andy Lutomirski
2021-06-02 21:28 ` Yu, Yu-cheng [this message]
2021-06-04 14:05 ` [patch 0/8] x86/fpu: Mop up XSAVES and related damage Thomas Gleixner
2021-06-04 16:27 ` Yu, Yu-cheng
2021-06-04 17:46 ` Dave Hansen
2021-06-04 18:14 ` Thomas Gleixner
2021-06-04 22:04 ` Dave Hansen
2021-06-05 10:18 ` Thomas Gleixner
2021-06-05 11:56 ` Thomas Gleixner
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=9c5c90bf-fbf6-7e45-4668-2f40f11e8b36@intel.com \
--to=yu-cheng.yu@intel.com \
--cc=dave.hansen@linux.intel.com \
--cc=fenghua.yu@intel.com \
--cc=linux-kernel@vger.kernel.org \
--cc=luto@kernel.org \
--cc=tglx@linutronix.de \
--cc=tony.luck@intel.com \
--cc=x86@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®