Re: [PATCH] x86/fpu: Remove dynamic features from xcomp_bv for init_fpstate

[Dave Hansen]

On 10/12/22 20:35, Yao, Yuan wrote:
> Below trace is observed on host kernel with this patch applied when create VM.
> 
> The reason is __copy_xstate_to_uabi_buf() copies data from &init_fpstate when the component
> is not existed in the source kernel fpstate (here is the AMX tile component), but the
> AMX TILE bit is removed from init_fpstate due to this patch, so the WARN is triggered and return
> NULL which causes kernel NULL pointer dereference later.
> 
> I considered 2 possible ways to fix this without big change:
> 1. For such non-exist component, we can fill the buffer in target fpstate to 0 and don't WARN if the bit is not set
>     in init_fpstate.
> 2. Enlarge the init_fpstate to content the dynamic components and still keel fpu_kernel_cfg.max_features
>     in init_fpstate (but still remove the dynamic bit from new cloned thread), so we can use it safely in above case,
>     but near 2 pages (8K) is wasted.

There's a bigger problem here.

Removing the AMX bit from xstate_bv just *TELLS* the __raw_xsave_addr()
about the buffer being too small.  Before this patch, __raw_xsave_addr()
was probably reading crap out of whatever is past 'init_fpstate' and
copying it out to userspace.

This mess makes me want a guard page after 'init_fpstate'.

Anyway, this isn't really a separate bug.  It's just more nasty fallout
from xcomp_bv being wrong in the first place.