Re: [patch V3 4/6] x86/pkru: Make PKRU=0 actually work

[Borislav Petkov]

Just typos:

On Tue, Jun 08, 2021 at 04:36:21PM +0200, Thomas Gleixner wrote:
> So that wreckages any copy_to/from_user() on the way back to user space

wrecks

> which hits memory which is protected by the default PKRU value.
> 
> Assumed that this does not fail (pure luck) then T1 goes back to user
> space and because TIF_NEED_FPU_LOAD is set it ends up in
> 
> switch_fpu_return()
>     __fpregs_load_activate()
>       if (!fpregs_state_valid()) {
> 	 load_XSTATE_from_task();
>       }
> 
> But if nothing touched the FPU between T1 scheduling out and in the
							       ^^

							s/in/if/ it seems.

> fpregs_state is valid so switch_fpu_return() does nothing and just clears
> TIF_NEED_FPU_LOAD. Back to user space with DEFAULT_PKRU loaded. -> FAIL #2!
> 
> The fix is simple: if get_xsave_addr() returns NULL then set the PKRU value
> to 0 instead of the restrictive default PKRU value.
> 
> Fixes: 0cecca9d03c9 ("x86/fpu: Eager switch PKRU state")
> Signed-off-by: Thomas Gleixner <tglx@xxxxxxxxxxxxx>
> Cc: Rik van Riel <riel@xxxxxxxxxxx>
> Cc: stable@xxxxxxxxxxxxxxx
> ---
>  arch/x86/include/asm/fpu/internal.h |   11 +++++++++--
>  1 file changed, 9 insertions(+), 2 deletions(-)
> 
> --- a/arch/x86/include/asm/fpu/internal.h
> +++ b/arch/x86/include/asm/fpu/internal.h
> @@ -579,9 +579,16 @@ static inline void switch_fpu_finish(str
>  	 * return to userland e.g. for a copy_to_user() operation.
>  	 */
>  	if (!(current->flags & PF_KTHREAD)) {
> +		/*
> +		 * If the PKRU bit in xsave.header.xfeatures is not set,
> +		 * then the PKRU compoment was in init state, which means
                                 ^^^^^^^^^

component

> +		 * XRSTOR will set PKRU to 0. If the bit is not set then
> +		 * get_xsave_addr() will return NULL because the PKRU value
> +		 * in memory is not valid. This means pkru_val has to be
> +		 * set to 0 and not to init_pkru_value.
> +		 */
>  		pk = get_xsave_addr(&new_fpu->state.xsave, XFEATURE_PKRU);
> -		if (pk)
> -			pkru_val = pk->pkru;
> +		pkru_val = pk ? pk->pkru : 0;
>  	}

Hohumm, let's see who cries out... :-\

-- 
Regards/Gruss,
    Boris.

https://people.kernel.org/tglx/notes-about-netiquette