From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751745AbdIUSyB (ORCPT ); Thu, 21 Sep 2017 14:54:01 -0400 Received: from mail-pg0-f67.google.com ([74.125.83.67]:35926 "EHLO mail-pg0-f67.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750790AbdIUSyA (ORCPT ); Thu, 21 Sep 2017 14:54:00 -0400 X-Google-Smtp-Source: AOwi7QBuFA/HTQRml9JgYnOyvFDXLuYsbf/j3zKXaRToLwAzv+rWzacAAjt6f3+cdpY66QCpJEXZow== From: Eric Biggers To: x86@kernel.org Cc: linux-kernel@vger.kernel.org, kernel-hardening@lists.openwall.com, Andy Lutomirski , Dave Hansen , Dmitry Vyukov , Fenghua Yu , Ingo Molnar , Kevin Hao , Oleg Nesterov , Wanpeng Li , Yu-cheng Yu , Michael Halcrow , Eric Biggers Subject: [PATCH v3 0/3] x86/fpu: prevent leaking FPU registers via invalid FPU state Date: Thu, 21 Sep 2017 11:52:36 -0700 Message-Id: <20170921185239.88398-1-ebiggers3@gmail.com> X-Mailer: git-send-email 2.14.1.821.g8fa685d3b7-goog Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Eric Biggers This series fixes the bug found by syzkaller where the ptrace syscall can be used to set invalid bits in a task's FPU state. I also found that an equivalent bug was reachable using the sigreturn syscall, so the first patch fixes the bug in both cases. The other two patches start validating the other parts of the xstate_header and make it so that invalid FPU states can no longer be abused to leak the FPU registers of other processes. Changes since v2: - Use an exception handler to handle invalid FPU states (suggested by Andy Lutomirski) - Check the size of xstate_header.reserved at build time (suggested by Dave Hansen) Eric Biggers (3): x86/fpu: don't let userspace set bogus xcomp_bv x86/fpu: tighten validation of user-supplied xstate_header x86/fpu: reinitialize FPU registers if restoring FPU state fails arch/x86/include/asm/fpu/internal.h | 51 +++++++++++-------------------------- arch/x86/include/asm/fpu/xstate.h | 25 ++++++++++++++++++ arch/x86/kernel/fpu/regset.c | 20 +++++++-------- arch/x86/kernel/fpu/signal.c | 15 ++++++++--- arch/x86/kernel/fpu/xstate.c | 27 ++++++++------------ arch/x86/mm/extable.c | 24 +++++++++++++++++ 6 files changed, 94 insertions(+), 68 deletions(-) -- 2.14.1.821.g8fa685d3b7-goog From mboxrd@z Thu Jan 1 00:00:00 1970 From: Eric Biggers Date: Thu, 21 Sep 2017 11:52:36 -0700 Message-Id: <20170921185239.88398-1-ebiggers3@gmail.com> Subject: [kernel-hardening] [PATCH v3 0/3] x86/fpu: prevent leaking FPU registers via invalid FPU state To: x86@kernel.org Cc: linux-kernel@vger.kernel.org, kernel-hardening@lists.openwall.com, Andy Lutomirski , Dave Hansen , Dmitry Vyukov , Fenghua Yu , Ingo Molnar , Kevin Hao , Oleg Nesterov , Wanpeng Li , Yu-cheng Yu , Michael Halcrow , Eric Biggers List-ID: From: Eric Biggers This series fixes the bug found by syzkaller where the ptrace syscall can be used to set invalid bits in a task's FPU state. I also found that an equivalent bug was reachable using the sigreturn syscall, so the first patch fixes the bug in both cases. The other two patches start validating the other parts of the xstate_header and make it so that invalid FPU states can no longer be abused to leak the FPU registers of other processes. Changes since v2: - Use an exception handler to handle invalid FPU states (suggested by Andy Lutomirski) - Check the size of xstate_header.reserved at build time (suggested by Dave Hansen) Eric Biggers (3): x86/fpu: don't let userspace set bogus xcomp_bv x86/fpu: tighten validation of user-supplied xstate_header x86/fpu: reinitialize FPU registers if restoring FPU state fails arch/x86/include/asm/fpu/internal.h | 51 +++++++++++-------------------------- arch/x86/include/asm/fpu/xstate.h | 25 ++++++++++++++++++ arch/x86/kernel/fpu/regset.c | 20 +++++++-------- arch/x86/kernel/fpu/signal.c | 15 ++++++++--- arch/x86/kernel/fpu/xstate.c | 27 ++++++++------------ arch/x86/mm/extable.c | 24 +++++++++++++++++ 6 files changed, 94 insertions(+), 68 deletions(-) -- 2.14.1.821.g8fa685d3b7-goog