From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S936284AbdIZIoK (ORCPT ); Tue, 26 Sep 2017 04:44:10 -0400 Received: from terminus.zytor.com ([65.50.211.136]:40703 "EHLO terminus.zytor.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S933842AbdIZIoF (ORCPT ); Tue, 26 Sep 2017 04:44:05 -0400 Date: Tue, 26 Sep 2017 01:35:10 -0700 From: tip-bot for Eric Biggers Message-ID: Cc: tglx@linutronix.de, dvyukov@google.com, mingo@kernel.org, oleg@redhat.com, riel@redhat.com, yu-cheng.yu@intel.com, torvalds@linux-foundation.org, hpa@zytor.com, bp@alien8.de, peterz@infradead.org, keescook@chromium.org, linux-kernel@vger.kernel.org, haokexin@gmail.com, dave.hansen@linux.intel.com, wanpeng.li@hotmail.com, fenghua.yu@intel.com, mhalcrow@google.com, akpm@linux-foundation.org, luto@amacapital.net, ebiggers@google.com, luto@kernel.org, ebiggers3@gmail.com Reply-To: dave.hansen@linux.intel.com, haokexin@gmail.com, linux-kernel@vger.kernel.org, mhalcrow@google.com, fenghua.yu@intel.com, wanpeng.li@hotmail.com, dvyukov@google.com, oleg@redhat.com, mingo@kernel.org, tglx@linutronix.de, bp@alien8.de, hpa@zytor.com, peterz@infradead.org, keescook@chromium.org, riel@redhat.com, yu-cheng.yu@intel.com, torvalds@linux-foundation.org, ebiggers@google.com, luto@amacapital.net, akpm@linux-foundation.org, ebiggers3@gmail.com, luto@kernel.org In-Reply-To: <20170924105913.9157-4-mingo@kernel.org> References: <20170924105913.9157-4-mingo@kernel.org> To: linux-tip-commits@vger.kernel.org Subject: [tip:x86/fpu] x86/fpu: Use validate_xstate_header() to validate the xstate_header in __fpu__restore_sig() Git-Commit-ID: b11e2e18a7fc8eaa3d592c260d50c7129e094ded X-Mailer: tip-git-log-daemon Robot-ID: Robot-Unsubscribe: Contact to get blacklisted from these emails MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Content-Type: text/plain; charset=UTF-8 Content-Disposition: inline Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Commit-ID: b11e2e18a7fc8eaa3d592c260d50c7129e094ded Gitweb: http://git.kernel.org/tip/b11e2e18a7fc8eaa3d592c260d50c7129e094ded Author: Eric Biggers AuthorDate: Sun, 24 Sep 2017 12:59:06 +0200 Committer: Ingo Molnar CommitDate: Tue, 26 Sep 2017 09:43:46 +0200 x86/fpu: Use validate_xstate_header() to validate the xstate_header in __fpu__restore_sig() Tighten the checks in __fpu__restore_sig() and update comments. Signed-off-by: Eric Biggers Cc: Andrew Morton Cc: Andy Lutomirski Cc: Andy Lutomirski Cc: Borislav Petkov Cc: Dave Hansen Cc: Dmitry Vyukov Cc: Eric Biggers Cc: Fenghua Yu Cc: Kees Cook Cc: Kevin Hao Cc: Linus Torvalds Cc: Michael Halcrow Cc: Oleg Nesterov Cc: Peter Zijlstra Cc: Rik van Riel Cc: Thomas Gleixner Cc: Wanpeng Li Cc: Yu-cheng Yu Cc: kernel-hardening@lists.openwall.com Link: http://lkml.kernel.org/r/20170924105913.9157-4-mingo@kernel.org Signed-off-by: Ingo Molnar --- arch/x86/kernel/fpu/signal.c | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-) diff --git a/arch/x86/kernel/fpu/signal.c b/arch/x86/kernel/fpu/signal.c index 7fa3bdb..fb639e7 100644 --- a/arch/x86/kernel/fpu/signal.c +++ b/arch/x86/kernel/fpu/signal.c @@ -214,8 +214,11 @@ sanitize_restored_xstate(struct task_struct *tsk, struct xstate_header *header = &xsave->header; if (use_xsave()) { - /* These bits must be zero. */ - memset(header->reserved, 0, 48); + /* + * Note: we don't need to zero the reserved bits in the + * xstate_header here because we either didn't copy them at all, + * or we checked earlier that they aren't set. + */ /* * Init the state that is not present in the memory @@ -224,7 +227,7 @@ sanitize_restored_xstate(struct task_struct *tsk, if (fx_only) header->xfeatures = XFEATURE_MASK_FPSSE; else - header->xfeatures &= (xfeatures_mask & xfeatures); + header->xfeatures &= xfeatures; } if (use_fxsr()) { @@ -308,7 +311,7 @@ static int __fpu__restore_sig(void __user *buf, void __user *buf_fx, int size) /* * For 32-bit frames with fxstate, copy the user state to the * thread's fpu state, reconstruct fxstate from the fsave - * header. Sanitize the copied state etc. + * header. Validate and sanitize the copied state. */ struct fpu *fpu = &tsk->thread.fpu; struct user_i387_ia32_struct env; @@ -329,9 +332,8 @@ static int __fpu__restore_sig(void __user *buf, void __user *buf_fx, int size) } else { err = __copy_from_user(&fpu->state.xsave, buf_fx, state_size); - /* xcomp_bv must be 0 when using uncompacted format */ - if (!err && state_size > offsetof(struct xregs_state, header) && fpu->state.xsave.header.xcomp_bv) - err = -EINVAL; + if (!err && state_size > offsetof(struct xregs_state, header)) + err = validate_xstate_header(&fpu->state.xsave.header); } if (err || __copy_from_user(&env, buf, sizeof(env))) {