[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Tue, 19 Sep 2017 17:44:31 -0700
From: Eric Biggers <ebiggers3@...il.com>
To: x86@...nel.org
Cc: linux-kernel@...r.kernel.org,
kernel-hardening@...ts.openwall.com,
Andy Lutomirski <luto@...nel.org>,
Dave Hansen <dave.hansen@...ux.intel.com>,
Dmitry Vyukov <dvyukov@...gle.com>,
Fenghua Yu <fenghua.yu@...el.com>,
Ingo Molnar <mingo@...nel.org>,
Kevin Hao <haokexin@...il.com>,
Oleg Nesterov <oleg@...hat.com>,
Wanpeng Li <wanpeng.li@...mail.com>,
Yu-cheng Yu <yu-cheng.yu@...el.com>,
Michael Halcrow <mhalcrow@...gle.com>,
Eric Biggers <ebiggers@...gle.com>
Subject: [PATCH v2 0/3] x86/fpu: prevent leaking FPU registers via invalid FPU state
From: Eric Biggers <ebiggers@...gle.com>
This is a second attempt to fix the bug found by syzkaller where the
ptrace syscall can be used to set invalid bits in a task's FPU state.
I also found that an equivalent bug was reachable using the sigreturn
syscall, so the first patch fixes the bug in both cases.
The other two patches start validating the other parts of the
xstate_header and make it so that invalid FPU states can no longer be
abused to leak the FPU registers of other processes.
Eric Biggers (3):
x86/fpu: don't let userspace set bogus xcomp_bv
x86/fpu: tighten validation of user-supplied xstate_header
x86/fpu: reinitialize FPU registers if restoring FPU state fails
arch/x86/include/asm/fpu/internal.h | 29 ++++++++++++++++++++---------
arch/x86/include/asm/fpu/xstate.h | 19 +++++++++++++++++++
arch/x86/kernel/fpu/core.c | 16 ++++++++++++++++
arch/x86/kernel/fpu/regset.c | 20 +++++++++-----------
arch/x86/kernel/fpu/signal.c | 15 +++++++++++----
arch/x86/kernel/fpu/xstate.c | 27 ++++++++++-----------------
6 files changed, 85 insertions(+), 41 deletions(-)
--
2.14.1.690.gbb1197296e-goog
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
