Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 18ecb3bf authored by Borislav Petkov's avatar Borislav Petkov Committed by Ingo Molnar
Browse files

x86/fpu: Load xsave pointer *after* initialization 



So I was playing with gdb today and did this simple thing:

	gdb /bin/ls

	...

	(gdb) run

Box exploded with this splat:

	BUG: unable to handle kernel NULL pointer dereference at 00000000000001d0
	IP: [<ffffffff8100fe5a>] xstateregs_get+0x7a/0x120
	[...]

	Call Trace:
	 ptrace_regset
	 ptrace_request
	 ? wait_task_inactive
	 ? preempt_count_sub
	 arch_ptrace
	 ? ptrace_get_task_struct
	 SyS_ptrace
	 system_call_fastpath

... because we do cache &target->thread.fpu.state->xsave into the
local variable xsave but that pointer is NULL at that time and
it gets initialized later, in init_fpu(), see:

	e7f180dc ("x86/fpu: Change xstateregs_get()/set() to use ->xsave.i387 rather than ->fxsave")

The fix is simple: load xsave *after* init_fpu() has run.

Also do the same in xstateregs_set(), as suggested by Oleg Nesterov.

Signed-off-by: default avatarBorislav Petkov <bp@suse.de>
Acked-by: default avatarOleg Nesterov <oleg@redhat.com>
Cc: Andy Lutomirski <luto@amacapital.net>
Cc: H. Peter Anvin <hpa@zytor.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Rik van Riel <riel@redhat.com>
Cc: Tavis Ormandy <taviso@google.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Link: http://lkml.kernel.org/r/1429209697-5902-1-git-send-email-bp@alien8.de


Signed-off-by: default avatarIngo Molnar <mingo@kernel.org>
parent fd0f86b6

arch/x86/kernel/i387.c

+6 −2
Original line number Original line Diff line number Diff line
@@ -341,7 +341,7 @@ int xstateregs_get(struct task_struct *target, const struct user_regset *regset, 
		unsigned int pos, unsigned int count,

		unsigned int pos, unsigned int count,

		void *kbuf, void __user *ubuf)

		void *kbuf, void __user *ubuf)

{

{

	struct xsave_struct *xsave = &target->thread.fpu.state->xsave;

	struct xsave_struct *xsave;

	int ret;

	int ret;





	if (!cpu_has_xsave)

	if (!cpu_has_xsave)
@@ -351,6 +351,8 @@ int xstateregs_get(struct task_struct *target, const struct user_regset *regset, 
	if (ret)

	if (ret)

		return ret;

		return ret;





	xsave = &target->thread.fpu.state->xsave;



	/*

	/*

	 * Copy the 48bytes defined by the software first into the xstate

	 * Copy the 48bytes defined by the software first into the xstate

	 * memory layout in the thread struct, so that we can copy the entire

	 * memory layout in the thread struct, so that we can copy the entire
@@ -369,7 +371,7 @@ int xstateregs_set(struct task_struct *target, const struct user_regset *regset, 
		  unsigned int pos, unsigned int count,

		  unsigned int pos, unsigned int count,

		  const void *kbuf, const void __user *ubuf)

		  const void *kbuf, const void __user *ubuf)

{

{

	struct xsave_struct *xsave = &target->thread.fpu.state->xsave;

	struct xsave_struct *xsave;

	int ret;

	int ret;





	if (!cpu_has_xsave)

	if (!cpu_has_xsave)
@@ -379,6 +381,8 @@ int xstateregs_set(struct task_struct *target, const struct user_regset *regset, 
	if (ret)

	if (ret)

		return ret;

		return ret;





	xsave = &target->thread.fpu.state->xsave;



	ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf, xsave, 0, -1);

	ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf, xsave, 0, -1);

	/*

	/*

	 * mxcsr reserved bits must be masked to zero for security reasons.

	 * mxcsr reserved bits must be masked to zero for security reasons.