From: Eric Biggers <ebiggers3@gmail.com> To: x86@kernel.org Cc: linux-kernel@vger.kernel.org, kernel-hardening@lists.openwall.com, Andy Lutomirski <luto@kernel.org>, Dave Hansen <dave.hansen@linux.intel.com>, Dmitry Vyukov <dvyukov@google.com>, Fenghua Yu <fenghua.yu@intel.com>, Ingo Molnar <mingo@kernel.org>, Kevin Hao <haokexin@gmail.com>, Oleg Nesterov <oleg@redhat.com>, Wanpeng Li <wanpeng.li@hotmail.com>, Yu-cheng Yu <yu-cheng.yu@intel.com>, Michael Halcrow <mhalcrow@google.com>, Eric Biggers <ebiggers@google.com> Subject: [PATCH v4 0/3] x86/fpu: prevent leaking FPU registers via invalid FPU state Date: Fri, 22 Sep 2017 10:41:53 -0700 [thread overview] Message-ID: <20170922174156.16780-1-ebiggers3@gmail.com> (raw) From: Eric Biggers <ebiggers@google.com> This series fixes the bug found by syzkaller where the ptrace syscall can be used to set invalid bits in a task's FPU state. I also found that an equivalent bug was reachable using the sigreturn syscall, so the first patch fixes the bug in both cases. The other two patches start validating the other parts of the xstate_header and make it so that invalid FPU states can no longer be abused to leak the FPU registers of other processes. Changes since v3: - Rebase onto tip/master Changes since v2: - Use an exception handler to handle invalid FPU states (suggested by Andy Lutomirski) - Check the size of xstate_header.reserved at build time (suggested by Dave Hansen) Eric Biggers (3): x86/fpu: don't let userspace set bogus xcomp_bv x86/fpu: tighten validation of user-supplied xstate_header x86/fpu: reinitialize FPU registers if restoring FPU state fails arch/x86/include/asm/fpu/internal.h | 51 +++++++++++------------------------- arch/x86/include/asm/fpu/xstate.h | 25 ++++++++++++++++++ arch/x86/kernel/fpu/regset.c | 17 +++++------- arch/x86/kernel/fpu/signal.c | 18 ++++++++----- arch/x86/kernel/fpu/xstate.c | 52 ++++++++++++++----------------------- arch/x86/mm/extable.c | 24 +++++++++++++++++ 6 files changed, 102 insertions(+), 85 deletions(-) -- 2.14.1.821.g8fa685d3b7-goog
WARNING: multiple messages have this Message-ID (diff)
From: Eric Biggers <ebiggers3@gmail.com> To: x86@kernel.org Cc: linux-kernel@vger.kernel.org, kernel-hardening@lists.openwall.com, Andy Lutomirski <luto@kernel.org>, Dave Hansen <dave.hansen@linux.intel.com>, Dmitry Vyukov <dvyukov@google.com>, Fenghua Yu <fenghua.yu@intel.com>, Ingo Molnar <mingo@kernel.org>, Kevin Hao <haokexin@gmail.com>, Oleg Nesterov <oleg@redhat.com>, Wanpeng Li <wanpeng.li@hotmail.com>, Yu-cheng Yu <yu-cheng.yu@intel.com>, Michael Halcrow <mhalcrow@google.com>, Eric Biggers <ebiggers@google.com> Subject: [kernel-hardening] [PATCH v4 0/3] x86/fpu: prevent leaking FPU registers via invalid FPU state Date: Fri, 22 Sep 2017 10:41:53 -0700 [thread overview] Message-ID: <20170922174156.16780-1-ebiggers3@gmail.com> (raw) From: Eric Biggers <ebiggers@google.com> This series fixes the bug found by syzkaller where the ptrace syscall can be used to set invalid bits in a task's FPU state. I also found that an equivalent bug was reachable using the sigreturn syscall, so the first patch fixes the bug in both cases. The other two patches start validating the other parts of the xstate_header and make it so that invalid FPU states can no longer be abused to leak the FPU registers of other processes. Changes since v3: - Rebase onto tip/master Changes since v2: - Use an exception handler to handle invalid FPU states (suggested by Andy Lutomirski) - Check the size of xstate_header.reserved at build time (suggested by Dave Hansen) Eric Biggers (3): x86/fpu: don't let userspace set bogus xcomp_bv x86/fpu: tighten validation of user-supplied xstate_header x86/fpu: reinitialize FPU registers if restoring FPU state fails arch/x86/include/asm/fpu/internal.h | 51 +++++++++++------------------------- arch/x86/include/asm/fpu/xstate.h | 25 ++++++++++++++++++ arch/x86/kernel/fpu/regset.c | 17 +++++------- arch/x86/kernel/fpu/signal.c | 18 ++++++++----- arch/x86/kernel/fpu/xstate.c | 52 ++++++++++++++----------------------- arch/x86/mm/extable.c | 24 +++++++++++++++++ 6 files changed, 102 insertions(+), 85 deletions(-) -- 2.14.1.821.g8fa685d3b7-goog
next reply other threads:[~2017-09-22 17:44 UTC|newest] Thread overview: 99+ messages / expand[flat|nested] mbox.gz Atom feed top 2017-09-22 17:41 Eric Biggers [this message] 2017-09-22 17:41 ` [kernel-hardening] [PATCH v4 0/3] x86/fpu: prevent leaking FPU registers via invalid FPU state Eric Biggers 2017-09-22 17:41 ` [PATCH v4 1/3] x86/fpu: don't let userspace set bogus xcomp_bv Eric Biggers 2017-09-22 17:41 ` [kernel-hardening] " Eric Biggers 2017-09-22 17:41 ` [PATCH v4 2/3] x86/fpu: tighten validation of user-supplied xstate_header Eric Biggers 2017-09-22 17:41 ` [kernel-hardening] " Eric Biggers 2017-09-22 17:41 ` [PATCH v4 3/3] x86/fpu: reinitialize FPU registers if restoring FPU state fails Eric Biggers 2017-09-22 17:41 ` [kernel-hardening] " Eric Biggers 2017-09-23 9:09 ` [PATCH v4 0/3] x86/fpu: prevent leaking FPU registers via invalid FPU state Ingo Molnar 2017-09-23 9:09 ` [kernel-hardening] " Ingo Molnar -- strict thread matches above, loose matches on Subject: below -- 2017-09-23 12:59 [PATCH 00/33] x86 FPU fixes and cleanups for v4.14 Ingo Molnar 2017-09-23 12:59 ` [PATCH 01/33] x86/fpu: Rename copyin_to_xsaves()/copyout_from_xsaves() to copy_user_to_xstate()/copy_xstate_to_user() Ingo Molnar 2017-09-26 8:21 ` [tip:x86/fpu] " tip-bot for Ingo Molnar 2017-09-23 12:59 ` [PATCH 02/33] x86/fpu: Split copy_xstate_to_user() into copy_xstate_to_kernel() & copy_xstate_to_user() Ingo Molnar 2017-09-26 8:22 ` [tip:x86/fpu] " tip-bot for Ingo Molnar 2017-09-23 12:59 ` [PATCH 03/33] x86/fpu: Remove 'ubuf' parameter from the copy_xstate_to_kernel() APIs Ingo Molnar 2017-09-26 8:22 ` [tip:x86/fpu] " tip-bot for Ingo Molnar 2017-09-23 12:59 ` [PATCH 04/33] x86/fpu: Remove 'kbuf' parameter from the copy_xstate_to_user() APIs Ingo Molnar 2017-09-26 8:23 ` [tip:x86/fpu] " tip-bot for Ingo Molnar 2017-09-23 12:59 ` [PATCH 05/33] x86/fpu: Clean up parameter order in the copy_xstate_to_*() APIs Ingo Molnar 2017-09-26 8:23 ` [tip:x86/fpu] " tip-bot for Ingo Molnar 2017-09-23 12:59 ` [PATCH 06/33] x86/fpu: Clean up the parameter definitions of copy_xstate_to_*() Ingo Molnar 2017-09-26 8:23 ` [tip:x86/fpu] " tip-bot for Ingo Molnar 2017-09-23 12:59 ` [PATCH 07/33] x86/fpu: Remove the 'start_pos' parameter from the __copy_xstate_to_*() functions Ingo Molnar 2017-09-26 8:24 ` [tip:x86/fpu] " tip-bot for Ingo Molnar 2017-09-23 12:59 ` [PATCH 08/33] x86/fpu: Clarify parameter names in the copy_xstate_to_*() methods Ingo Molnar 2017-09-25 19:56 ` Thomas Gleixner 2017-09-25 20:01 ` Thomas Gleixner 2017-09-26 8:24 ` [tip:x86/fpu] " tip-bot for Ingo Molnar 2017-09-23 12:59 ` [PATCH 09/33] x86/fpu: Change 'size_total' parameter to unsigned and standardize the size checks in copy_xstate_to_*() Ingo Molnar 2017-09-26 8:25 ` [tip:x86/fpu] " tip-bot for Ingo Molnar 2017-09-23 12:59 ` [PATCH 10/33] x86/fpu: Simplify __copy_xstate_to_kernel() return values Ingo Molnar 2017-09-26 8:25 ` [tip:x86/fpu] " tip-bot for Ingo Molnar 2017-09-23 12:59 ` [PATCH 11/33] x86/fpu: Split copy_user_to_xstate() into copy_kernel_to_xstate() & copy_user_to_xstate() Ingo Molnar 2017-09-26 8:25 ` [tip:x86/fpu] " tip-bot for Ingo Molnar 2017-09-23 12:59 ` [PATCH 12/33] x86/fpu: Remove 'ubuf' parameter from the copy_kernel_to_xstate() API Ingo Molnar 2017-09-26 8:26 ` [tip:x86/fpu] " tip-bot for Ingo Molnar 2017-09-23 12:59 ` [PATCH 13/33] x86/fpu: Remove 'kbuf' parameter from the copy_user_to_xstate() API Ingo Molnar 2017-09-26 8:26 ` [tip:x86/fpu] " tip-bot for Ingo Molnar 2017-09-23 12:59 ` [PATCH 14/33] x86/fpu: Flip the parameter order in copy_*_to_xstate() Ingo Molnar 2017-09-26 8:27 ` [tip:x86/fpu] " tip-bot for Ingo Molnar 2017-09-23 12:59 ` [PATCH 15/33] x86/fpu: Simplify fpu->fpregs_active use Ingo Molnar 2017-09-26 8:27 ` [tip:x86/fpu] " tip-bot for Ingo Molnar 2017-09-23 12:59 ` [PATCH 16/33] x86/fpu: Make the fpu state change in fpu__clear() scheduler-atomic Ingo Molnar 2017-09-26 8:27 ` [tip:x86/fpu] " tip-bot for Ingo Molnar 2017-09-23 13:00 ` [PATCH 17/33] x86/fpu: Split the state handling in fpu__drop() Ingo Molnar 2017-09-26 8:28 ` [tip:x86/fpu] " tip-bot for Ingo Molnar 2017-09-23 13:00 ` [PATCH 18/33] x86/fpu: Change fpu->fpregs_active users to fpu->fpstate_active Ingo Molnar 2017-09-26 8:28 ` [tip:x86/fpu] " tip-bot for Ingo Molnar 2017-09-23 13:00 ` [PATCH 19/33] x86/fpu: Decouple fpregs_activate()/fpregs_deactivate() from fpu->fpregs_active Ingo Molnar 2017-09-26 8:28 ` [tip:x86/fpu] " tip-bot for Ingo Molnar 2017-09-23 13:00 ` [PATCH 20/33] x86/fpu: Remove struct fpu::fpregs_active Ingo Molnar 2017-09-26 8:29 ` [tip:x86/fpu] " tip-bot for Ingo Molnar 2017-09-23 13:00 ` [PATCH 21/33] x86/fpu: Add FPU state copying quirk to handle XRSTOR failure on Intel Skylake CPUs Ingo Molnar 2017-09-26 8:29 ` [tip:x86/fpu] " tip-bot for Rik van Riel 2017-09-23 13:00 ` [PATCH 22/33] x86/fpu: Fix boolreturn.cocci warnings Ingo Molnar 2017-09-26 8:30 ` [tip:x86/fpu] " tip-bot for kbuild test robot 2017-09-23 13:00 ` [PATCH 23/33] x86/fpu: Turn WARN_ON() in context switch into WARN_ON_FPU() Ingo Molnar 2017-09-26 8:30 ` [tip:x86/fpu] " tip-bot for Andi Kleen 2017-09-23 13:00 ` [PATCH 24/33] x86/fpu: Don't let userspace set bogus xcomp_bv Ingo Molnar 2017-09-26 8:30 ` [tip:x86/fpu] " tip-bot for Eric Biggers 2017-09-23 13:00 ` [PATCH 25/33] x86/fpu: Tighten validation of user-supplied xstate_header Ingo Molnar 2017-09-23 13:00 ` [PATCH 26/33] x86/fpu: Reinitialize FPU registers if restoring FPU state fails Ingo Molnar 2017-09-26 8:31 ` [tip:x86/fpu] " tip-bot for Eric Biggers 2017-09-23 13:00 ` [PATCH 27/33] x86/fpu: Simplify fpu__activate_fpstate_read() Ingo Molnar 2017-09-26 8:31 ` [tip:x86/fpu] x86/fpu: Fix fpu__activate_fpstate_read() and update comments tip-bot for Ingo Molnar 2017-09-23 13:00 ` [PATCH 28/33] x86/fpu: Remove fpu__current_fpstate_write_begin/end() Ingo Molnar 2017-09-26 8:32 ` [tip:x86/fpu] " tip-bot for Ingo Molnar 2017-09-23 13:00 ` [PATCH 29/33] x86/fpu: Rename fpu::fpstate_active to fpu::initialized Ingo Molnar 2017-09-26 8:32 ` [tip:x86/fpu] " tip-bot for Ingo Molnar 2017-09-23 13:00 ` [PATCH 30/33] x86/fpu: Fix stale comments about lazy FPU logic Ingo Molnar 2017-09-26 8:32 ` [tip:x86/fpu] " tip-bot for Ingo Molnar 2017-09-23 13:00 ` [PATCH 31/33] x86/fpu: Simplify and speed up fpu__copy() Ingo Molnar 2017-09-26 8:33 ` [tip:x86/fpu] " tip-bot for Ingo Molnar 2017-09-23 13:00 ` [PATCH 32/33] x86/fpu: Rename fpu__activate_curr() to fpu__initialize() Ingo Molnar 2017-09-26 8:33 ` [tip:x86/fpu] " tip-bot for Ingo Molnar 2017-09-23 13:00 ` [PATCH 33/33] x86/fpu: Rename fpu__activate_fpstate_read/write() to fpu__read/write() Ingo Molnar 2017-09-23 13:02 ` [PATCH 00/33] x86 FPU fixes and cleanups for v4.14 Ingo Molnar 2017-09-23 15:03 ` Juergen Gross 2017-09-23 23:27 ` Ingo Molnar 2017-03-29 6:26 [PATCH] x86/fpu: Turn WARN_ON in context switch into WARN_ON_FPU Andi Kleen 2017-04-24 21:00 ` [tip:perf/core] x86/fpu: Turn WARN_ON() in context switch into WARN_ON_FPU() tip-bot for Andi Kleen 2017-03-06 0:45 [tip:WIP.x86/fpu 31/31] arch/x86/kernel/fpu/xstate.c:931:9-10: WARNING: return of 0/1 in function 'xfeatures_mxcsr_quirk' with return type bool kbuild test robot 2017-03-06 0:45 ` [PATCH] x86/fpu: fix boolreturn.cocci warnings kbuild test robot 2017-03-07 7:23 ` Ingo Molnar 2017-03-07 8:33 ` Thomas Gleixner 2017-03-07 9:01 ` Ingo Molnar 2017-03-07 12:01 ` Joe Perches 2017-04-24 20:54 ` [tip:perf/core] x86/fpu: Fix " tip-bot for kbuild test robot 2017-02-09 23:43 [PATCH v2] x86/fpu: copy MXCSR & MXCSR_FLAGS with SSE/YMM state Rik van Riel 2017-02-10 0:02 ` Borislav Petkov 2017-02-10 0:51 ` Rik van Riel 2017-02-10 8:00 ` Ingo Molnar 2017-02-10 13:54 ` [PATCH v3] " Rik van Riel 2017-02-11 10:02 ` Ingo Molnar 2017-04-24 20:54 ` [tip:perf/core] x86/fpu: Add FPU state copying quirk to handle XRSTOR failure on Intel Skylake CPUs tip-bot for Rik van Riel 2017-02-10 0:45 ` [PATCH v2] x86/fpu: copy MXCSR & MXCSR_FLAGS with SSE/YMM state Yu-cheng Yu 2017-02-10 1:00 ` Rik van Riel 2017-02-10 17:18 ` Yu-cheng Yu
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=20170922174156.16780-1-ebiggers3@gmail.com \ --to=ebiggers3@gmail.com \ --cc=dave.hansen@linux.intel.com \ --cc=dvyukov@google.com \ --cc=ebiggers@google.com \ --cc=fenghua.yu@intel.com \ --cc=haokexin@gmail.com \ --cc=kernel-hardening@lists.openwall.com \ --cc=linux-kernel@vger.kernel.org \ --cc=luto@kernel.org \ --cc=mhalcrow@google.com \ --cc=mingo@kernel.org \ --cc=oleg@redhat.com \ --cc=wanpeng.li@hotmail.com \ --cc=x86@kernel.org \ --cc=yu-cheng.yu@intel.com \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.