From: Yu-cheng Yu <yu-cheng.yu@intel.com>
To: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Cc: linux-kernel@vger.kernel.org, x86@kernel.org,
"H. Peter Anvin" <hpa@zytor.com>,
Thomas Gleixner <tglx@linutronix.de>,
Ingo Molnar <mingo@redhat.com>,
Dave Hansen <dave.hansen@linux.intel.com>,
Tony Luck <tony.luck@intel.com>,
Andy Lutomirski <luto@kernel.org>, Borislav Petkov <bp@alien8.de>,
Rik van Riel <riel@surriel.com>,
"Ravi V. Shankar" <ravi.v.shankar@intel.com>,
Fenghua Yu <fenghua.yu@intel.com>,
Peter Zijlstra <peterz@infradead.org>, sam <sunhaoyl@outlook.com>,
Kees Cook <keescook@chromium.org>,
Alexey Dobriyan <adobriyan@gmail.com>,
Dave Hansen <dave.hansen@intel.com>, Jann Horn <jannh@google.com>,
Andrew Morton <akpm@linux-foundation.org>,
Alexander Potapenko <glider@google.com>,
Al Viro <viro@zeniv.linux.org.uk>,
stable@vger.kernel.org
Subject: Re: [PATCH] x86/fpu/xstate: Clear uninitialized xstate areas in core dump
Date: Thu, 07 May 2020 10:11:25 -0700 [thread overview]
Message-ID: <a40f3834f953da91dee719c1a801761405dc4780.camel@intel.com> (raw)
In-Reply-To: <20200507165652.s2cuaxasa2t5wkhx@linutronix.de>
On Thu, 2020-05-07 at 18:56 +0200, Sebastian Andrzej Siewior wrote:
> On 2020-05-07 09:49:04 [-0700], Yu-cheng Yu wrote:
> > In a core dump, copy_xstate_to_kernel() copies only enabled user xfeatures
> > to a kernel buffer without touching areas for disabled xfeatures. However,
> > those uninitialized areas may contain random data, which is then written to
> > the core dump file and can be read by a non-privileged user.
> >
> > Fix it by clearing uninitialized areas.
>
> Is the problem that copy_xstate_to_kernel() gets `kbuf' passed which
> isn't zeroed? If so, would it work clean that upfront?
Alexander Potapenko's patch (in the Link:) fixes the buffer in
fill_thread_core_info(). My patch prevents the same issue if this function is
called from somewhere else in the future.
Yu-cheng
next prev parent reply other threads:[~2020-05-07 17:11 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-05-07 16:49 [PATCH] x86/fpu/xstate: Clear uninitialized xstate areas in core dump Yu-cheng Yu
2020-05-07 16:52 ` Dave Hansen
2020-05-07 17:12 ` Yu-cheng Yu
2020-05-07 16:56 ` Sebastian Andrzej Siewior
2020-05-07 17:11 ` Yu-cheng Yu [this message]
2020-05-07 18:22 ` Thomas Gleixner
2020-05-07 18:41 ` Yu-cheng Yu
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=a40f3834f953da91dee719c1a801761405dc4780.camel@intel.com \
--to=yu-cheng.yu@intel.com \
--cc=adobriyan@gmail.com \
--cc=akpm@linux-foundation.org \
--cc=bigeasy@linutronix.de \
--cc=bp@alien8.de \
--cc=dave.hansen@intel.com \
--cc=dave.hansen@linux.intel.com \
--cc=fenghua.yu@intel.com \
--cc=glider@google.com \
--cc=hpa@zytor.com \
--cc=jannh@google.com \
--cc=keescook@chromium.org \
--cc=linux-kernel@vger.kernel.org \
--cc=luto@kernel.org \
--cc=mingo@redhat.com \
--cc=peterz@infradead.org \
--cc=ravi.v.shankar@intel.com \
--cc=riel@surriel.com \
--cc=stable@vger.kernel.org \
--cc=sunhaoyl@outlook.com \
--cc=tglx@linutronix.de \
--cc=tony.luck@intel.com \
--cc=viro@zeniv.linux.org.uk \
--cc=x86@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.