From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753149AbbDRKPM (ORCPT ); Sat, 18 Apr 2015 06:15:12 -0400 Received: from terminus.zytor.com ([198.137.202.10]:40798 "EHLO terminus.zytor.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752054AbbDRKPJ (ORCPT ); Sat, 18 Apr 2015 06:15:09 -0400 Date: Sat, 18 Apr 2015 03:14:44 -0700 From: tip-bot for Borislav Petkov Message-ID: Cc: bp@suse.de, torvalds@linux-foundation.org, mingo@kernel.org, riel@redhat.com, linux-kernel@vger.kernel.org, oleg@redhat.com, tglx@linutronix.de, luto@amacapital.net, taviso@google.com, hpa@zytor.com Reply-To: torvalds@linux-foundation.org, bp@suse.de, mingo@kernel.org, tglx@linutronix.de, linux-kernel@vger.kernel.org, oleg@redhat.com, riel@redhat.com, hpa@zytor.com, luto@amacapital.net, taviso@google.com In-Reply-To: <1429209697-5902-1-git-send-email-bp@alien8.de> References: <1429209697-5902-1-git-send-email-bp@alien8.de> To: linux-tip-commits@vger.kernel.org Subject: [tip:x86/urgent] x86/fpu: Load xsave pointer *after* initialization Git-Commit-ID: 18ecb3bfa5a9f6fffbb3eeb4369f0b9463438ec0 X-Mailer: tip-git-log-daemon Robot-ID: Robot-Unsubscribe: Contact to get blacklisted from these emails MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Content-Type: text/plain; charset=UTF-8 Content-Disposition: inline Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Commit-ID: 18ecb3bfa5a9f6fffbb3eeb4369f0b9463438ec0 Gitweb: http://git.kernel.org/tip/18ecb3bfa5a9f6fffbb3eeb4369f0b9463438ec0 Author: Borislav Petkov AuthorDate: Thu, 16 Apr 2015 20:41:37 +0200 Committer: Ingo Molnar CommitDate: Fri, 17 Apr 2015 10:15:47 +0200 x86/fpu: Load xsave pointer *after* initialization So I was playing with gdb today and did this simple thing: gdb /bin/ls ... (gdb) run Box exploded with this splat: BUG: unable to handle kernel NULL pointer dereference at 00000000000001d0 IP: [] xstateregs_get+0x7a/0x120 [...] Call Trace: ptrace_regset ptrace_request ? wait_task_inactive ? preempt_count_sub arch_ptrace ? ptrace_get_task_struct SyS_ptrace system_call_fastpath ... because we do cache &target->thread.fpu.state->xsave into the local variable xsave but that pointer is NULL at that time and it gets initialized later, in init_fpu(), see: e7f180dcd8ab ("x86/fpu: Change xstateregs_get()/set() to use ->xsave.i387 rather than ->fxsave") The fix is simple: load xsave *after* init_fpu() has run. Also do the same in xstateregs_set(), as suggested by Oleg Nesterov. Signed-off-by: Borislav Petkov Acked-by: Oleg Nesterov Cc: Andy Lutomirski Cc: H. Peter Anvin Cc: Linus Torvalds Cc: Rik van Riel Cc: Tavis Ormandy Cc: Thomas Gleixner Link: http://lkml.kernel.org/r/1429209697-5902-1-git-send-email-bp@alien8.de Signed-off-by: Ingo Molnar --- arch/x86/kernel/i387.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/arch/x86/kernel/i387.c b/arch/x86/kernel/i387.c index 367f39d..00918327 100644 --- a/arch/x86/kernel/i387.c +++ b/arch/x86/kernel/i387.c @@ -341,7 +341,7 @@ int xstateregs_get(struct task_struct *target, const struct user_regset *regset, unsigned int pos, unsigned int count, void *kbuf, void __user *ubuf) { - struct xsave_struct *xsave = &target->thread.fpu.state->xsave; + struct xsave_struct *xsave; int ret; if (!cpu_has_xsave) @@ -351,6 +351,8 @@ int xstateregs_get(struct task_struct *target, const struct user_regset *regset, if (ret) return ret; + xsave = &target->thread.fpu.state->xsave; + /* * Copy the 48bytes defined by the software first into the xstate * memory layout in the thread struct, so that we can copy the entire @@ -369,7 +371,7 @@ int xstateregs_set(struct task_struct *target, const struct user_regset *regset, unsigned int pos, unsigned int count, const void *kbuf, const void __user *ubuf) { - struct xsave_struct *xsave = &target->thread.fpu.state->xsave; + struct xsave_struct *xsave; int ret; if (!cpu_has_xsave) @@ -379,6 +381,8 @@ int xstateregs_set(struct task_struct *target, const struct user_regset *regset, if (ret) return ret; + xsave = &target->thread.fpu.state->xsave; + ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf, xsave, 0, -1); /* * mxcsr reserved bits must be masked to zero for security reasons.