x86/fpu: prevent leaking FPU registers via invalid FPU state
Get series with b4
b4 am [email protected]Versions newest first · linked by author and title
- v4 Latest3 patches 1 replyIn review
- v33 patches 5 repliesSuperseded
- v23 patches 5 repliesSuperseded
Earlier versions · 1
| Version | Posted | Patches | Replies | Status |
|---|---|---|---|---|
| v1 | 1 patch | 1 reply | Superseded |
Changes in v4 from the cover letter
- Rebase onto tip/master
Patches in v4 No applies recorded yet
| # | Subject and files | Size | Replies | Applied |
|---|---|---|---|---|
| 1/3 | x86/fpu: don't let userspace set bogus xcomp_bvarch/ arch/ | +11 | 0 replies | |
| 2/3 | x86/fpu: tighten validation of user-supplied xstate_headerarch/ arch/ arch/ +1 more | +60 | 0 replies | |
| 3/3 | x86/fpu: reinitialize FPU registers if restoring FPU state failsarch/ arch/ | +39 | 0 replies |
Reviews trailers per patch
All 3 patches have a Reviewed-by or Acked-by.
| Patch | Kees Cook | Rik van Riel | Dave Hansen |
|---|---|---|---|
| 1/3 | R-b | R-b | A-b |
| 2/3 | R-b | R-b | A-b |
| 3/3 | R-b |
Trailers given in replies are filled; those carried in the patches from earlier versions are outlined with dashes. Scroll the table sideways for all 3 reviewers.
Cover letter [PATCH v4 0/3] x86/fpu: prevent leaking FPU registers via invalid FPU state
From: Eric Biggers <[email protected]>
This series fixes the bug found by syzkaller where the ptrace syscall can be used to set invalid bits in a task's FPU state. I also found that an equivalent bug was reachable using the sigreturn syscall, so the first patch fixes the bug in both cases.
The other two patches start validating the other parts of the xstate_header and make it so that invalid FPU states can no longer be abused to leak the FPU registers of other processes.
Changes since v3:
- Rebase onto tip/master
Changes since v2:
- Use an exception handler to handle invalid FPU states (suggested by Andy Lutomirski)
- Check the size of xstate_header.reserved at build time (suggested by Dave Hansen)
Eric Biggers (3):
x86/fpu: don't let userspace set bogus xcomp_bv x86/fpu: tighten validation of user-supplied xstate_header x86/fpu: reinitialize FPU registers if restoring FPU state fails
arch/x86/include/asm/fpu/internal.h | 51 +++++++++++------------------------- arch/x86/include/asm/fpu/xstate.h | 25 ++++++++++++++++++ arch/x86/kernel/fpu/regset.c | 17 +++++------- arch/x86/kernel/fpu/signal.c | 18 ++++++++----- arch/x86/kernel/fpu/xstate.c | 52 ++++++++++++++----------------------- arch/x86/mm/extable.c | 24 +++++++++++++++++ 6 files changed, 102 insertions(+), 85 deletions(-)
Signature · 1 line
2.14.1.821.g8fa685d3b7-goog