Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Tue, 19 Sep 2017 20:18:28 -0700
From: Eric Biggers <ebiggers3@...il.com>
To: x86@...nel.org
Cc: linux-kernel@...r.kernel.org, kernel-hardening@...ts.openwall.com,
	Andy Lutomirski <luto@...nel.org>,
	Dave Hansen <dave.hansen@...ux.intel.com>,
	Dmitry Vyukov <dvyukov@...gle.com>,
	Fenghua Yu <fenghua.yu@...el.com>, Ingo Molnar <mingo@...nel.org>,
	Kevin Hao <haokexin@...il.com>, Oleg Nesterov <oleg@...hat.com>,
	Wanpeng Li <wanpeng.li@...mail.com>,
	Yu-cheng Yu <yu-cheng.yu@...el.com>,
	Michael Halcrow <mhalcrow@...gle.com>,
	Eric Biggers <ebiggers@...gle.com>
Subject: Re: [PATCH v2 3/3] x86/fpu: reinitialize FPU registers if restoring
 FPU state fails

On Tue, Sep 19, 2017 at 05:44:34PM -0700, Eric Biggers wrote:
> +/*
> + * We should never get here because the fpregs_state stored in 'struct fpu'
> + * should always be readable and contain a valid FPU state.  However, past bugs
> + * have allowed userspace to set reserved bits in the XSAVE area using
> + * PTRACE_SETREGSET or sys_rt_sigreturn().  These caused XRSTOR to fail when
> + * switching to the task, leaking the FPU registers of the task previously
> + * executing on the CPU.  Mitigate this class of vulnerability by restoring from
> + * the initial state (essentially, zeroing out all the FPU registers) if we
> + * can't restore from the task's FPU state.
> + */
> +void __handle_bad_fpstate(union fpregs_state *fpstate, u64 mask)
> +{
> +	WARN_ONCE(1, "Bad FPU state detected, reinitializing FPU registers");
> +	____copy_kernel_to_fpregs(&init_fpstate, mask);
> +}

Sorry, a small oversight here --- this needs to be exported to modules, since
kvm can be built as a module, and kvm uses __copy_kernel_to_fpregs().

Eric

Powered by blists - more mailing lists

Your e-mail address:

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.