Re: [patch V3 01/66] x86/fpu: x86/fpu: Preserve supervisor states in sanitize_restored_user_xstate()

[Borislav Petkov]

On Fri, Jun 18, 2021 at 04:18:24PM +0200, Thomas Gleixner wrote:
> Subject: Re: [patch V3 01/66] x86/fpu: x86/fpu: Preserve supervisor states in

Prefix repeated.

> From: Thomas Gleixner <tglx@xxxxxxxxxxxxx>
> 
> sanitize_restored_user_xstate() preserves the supervisor states only
> when the fx_only argument is zero, which allows unpriviledged user space
> to put supervisor states back into init state.

Yikes.

> Preserve them unconditionally.
> 
> Fixes: 5d6b6a6f9b5c ("x86/fpu/xstate: Update sanitize_restored_xstate() for supervisor xstates")
> Signed-off-by: Thomas Gleixner <tglx@xxxxxxxxxxxxx>
> Cc: stable@xxxxxxxxxxxxxxx
> ---
>  arch/x86/kernel/fpu/signal.c |   26 ++++++++------------------
>  1 file changed, 8 insertions(+), 18 deletions(-)
> 
> --- a/arch/x86/kernel/fpu/signal.c
> +++ b/arch/x86/kernel/fpu/signal.c
> @@ -221,28 +221,18 @@ sanitize_restored_user_xstate(union fpre
>  
>  	if (use_xsave()) {
>  		/*
> -		 * Note: we don't need to zero the reserved bits in the
> -		 * xstate_header here because we either didn't copy them at all,
> -		 * or we checked earlier that they aren't set.
> +		 * Clear all features bit which are not set in

			    feature bits

> +		 * user_xfeatures and clear all extended features
> +		 * for fx_only mode.
>  		 */
> +		u64 mask = fx_only ? XFEATURE_MASK_FPSSE : user_xfeatures;
>  
>  		/*
> -		 * 'user_xfeatures' might have bits clear which are
> -		 * set in header->xfeatures. This represents features that
> -		 * were in init state prior to a signal delivery, and need
> -		 * to be reset back to the init state.  Clear any user
> -		 * feature bits which are set in the kernel buffer to get
> -		 * them back to the init state.
> -		 *
> -		 * Supervisor state is unchanged by input from userspace.
> -		 * Ensure supervisor state bits stay set and supervisor
> -		 * state is not modified.
> +		 * Supervisor state has to be preserved. The sigframe
> +		 * restore can only modify user features, i.e. @mask
> +		 * cannot contain them.
>  		 */
> -		if (fx_only)
> -			header->xfeatures = XFEATURE_MASK_FPSSE;
> -		else
> -			header->xfeatures &= user_xfeatures |
> -					     xfeatures_mask_supervisor();
> +		header->xfeatures &= mask | xfeatures_mask_supervisor();

With those addressed:

Reviewed-by: Borislav Petkov <bp@xxxxxxx>

Thx.

-- 
Regards/Gruss,
    Boris.

SUSE Software Solutions Germany GmbH, GF: Felix Imendörffer, HRB 36809, AG Nürnberg