Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 47dc81ce authored by Al Viro's avatar Al Viro Committed by Greg Kroah-Hartman
Browse files

copy_xstate_to_kernel(): don't leave parts of destination uninitialized 



commit 9e4636545933131de15e1ecd06733538ae939b2f upstream.

copy the corresponding pieces of init_fpstate into the gaps instead.

Cc: stable@kernel.org
Tested-by: default avatarAlexander Potapenko <glider@google.com>
Acked-by: default avatarBorislav Petkov <bp@suse.de>
Signed-off-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 94690ca1

arch/x86/kernel/fpu/xstate.c

+48 −38
Original line number Diff line number Diff line
@@ -952,18 +952,31 @@ static inline bool xfeatures_mxcsr_quirk(u64 xfeatures) 
	return true;

}



/*

 * This is similar to user_regset_copyout(), but will not add offset to

 * the source data pointer or increment pos, count, kbuf, and ubuf.

 */

static inline void

__copy_xstate_to_kernel(void *kbuf, const void *data,

			unsigned int offset, unsigned int size, unsigned int size_total)

static void fill_gap(unsigned to, void **kbuf, unsigned *pos, unsigned *count)

{

	if (offset < size_total) {

		unsigned int copy = min(size, size_total - offset);

	if (*pos < to) {

		unsigned size = to - *pos;



		memcpy(kbuf + offset, data, copy);

		if (size > *count)

			size = *count;

		memcpy(*kbuf, (void *)&init_fpstate.xsave + *pos, size);

		*kbuf += size;

		*pos += size;

		*count -= size;

	}

}



static void copy_part(unsigned offset, unsigned size, void *from,

			void **kbuf, unsigned *pos, unsigned *count)

{

	fill_gap(offset, kbuf, pos, count);

	if (size > *count)

		size = *count;

	if (size) {

		memcpy(*kbuf, from, size);

		*kbuf += size;

		*pos += size;

		*count -= size;

	}

}
@@ -976,8 +989,9 @@ __copy_xstate_to_kernel(void *kbuf, const void *data, 
 */

int copy_xstate_to_kernel(void *kbuf, struct xregs_state *xsave, unsigned int offset_start, unsigned int size_total)

{

	unsigned int offset, size;

	struct xstate_header header;

	const unsigned off_mxcsr = offsetof(struct fxregs_state, mxcsr);

	unsigned count = size_total;

	int i;



	/*
@@ -993,46 +1007,42 @@ int copy_xstate_to_kernel(void *kbuf, struct xregs_state *xsave, unsigned int of 
	header.xfeatures = xsave->header.xfeatures;

	header.xfeatures &= ~XFEATURE_MASK_SUPERVISOR;



	if (header.xfeatures & XFEATURE_MASK_FP)

		copy_part(0, off_mxcsr,

			  &xsave->i387, &kbuf, &offset_start, &count);

	if (header.xfeatures & (XFEATURE_MASK_SSE | XFEATURE_MASK_YMM))

		copy_part(off_mxcsr, MXCSR_AND_FLAGS_SIZE,

			  &xsave->i387.mxcsr, &kbuf, &offset_start, &count);

	if (header.xfeatures & XFEATURE_MASK_FP)

		copy_part(offsetof(struct fxregs_state, st_space), 128,

			  &xsave->i387.st_space, &kbuf, &offset_start, &count);

	if (header.xfeatures & XFEATURE_MASK_SSE)

		copy_part(xstate_offsets[XFEATURE_MASK_SSE], 256,

			  &xsave->i387.xmm_space, &kbuf, &offset_start, &count);

	/*

	 * Fill xsave->i387.sw_reserved value for ptrace frame:

	 */

	copy_part(offsetof(struct fxregs_state, sw_reserved), 48,

		  xstate_fx_sw_bytes, &kbuf, &offset_start, &count);

	/*

	 * Copy xregs_state->header:

	 */

	offset = offsetof(struct xregs_state, header);

	size = sizeof(header);

	copy_part(offsetof(struct xregs_state, header), sizeof(header),

		  &header, &kbuf, &offset_start, &count);



	__copy_xstate_to_kernel(kbuf, &header, offset, size, size_total);



	for (i = 0; i < XFEATURE_MAX; i++) {

	for (i = FIRST_EXTENDED_XFEATURE; i < XFEATURE_MAX; i++) {

		/*

		 * Copy only in-use xstates:

		 */

		if ((header.xfeatures >> i) & 1) {

			void *src = __raw_xsave_addr(xsave, i);



			offset = xstate_offsets[i];

			size = xstate_sizes[i];



			/* The next component has to fit fully into the output buffer: */

			if (offset + size > size_total)

				break;



			__copy_xstate_to_kernel(kbuf, src, offset, size, size_total);

		}



			copy_part(xstate_offsets[i], xstate_sizes[i],

				  src, &kbuf, &offset_start, &count);

		}



	if (xfeatures_mxcsr_quirk(header.xfeatures)) {

		offset = offsetof(struct fxregs_state, mxcsr);

		size = MXCSR_AND_FLAGS_SIZE;

		__copy_xstate_to_kernel(kbuf, &xsave->i387.mxcsr, offset, size, size_total);

	}



	/*

	 * Fill xsave->i387.sw_reserved value for ptrace frame:

	 */

	offset = offsetof(struct fxregs_state, sw_reserved);

	size = sizeof(xstate_fx_sw_bytes);



	__copy_xstate_to_kernel(kbuf, xstate_fx_sw_bytes, offset, size, size_total);

	fill_gap(size_total, &kbuf, &offset_start, &count);



	return 0;

}