From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-9.0 required=3.0 tests=HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_PATCH,MAILING_LIST_MULTI,SIGNED_OFF_BY,SPF_PASS,URIBL_BLOCKED, USER_AGENT_NEOMUTT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id DED0CC43441 for ; Mon, 12 Nov 2018 15:56:52 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id B32A4224E0 for ; Mon, 12 Nov 2018 15:56:52 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org B32A4224E0 Authentication-Results: mail.kernel.org; dmarc=none (p=none dis=none) header.from=linutronix.de Authentication-Results: mail.kernel.org; spf=none smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1729738AbeKMBuk (ORCPT ); Mon, 12 Nov 2018 20:50:40 -0500 Received: from Galois.linutronix.de ([146.0.238.70]:52050 "EHLO Galois.linutronix.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726385AbeKMBuk (ORCPT ); Mon, 12 Nov 2018 20:50:40 -0500 Received: from bigeasy by Galois.linutronix.de with local (Exim 4.80) (envelope-from ) id 1gMEZv-0001ya-BS; Mon, 12 Nov 2018 16:56:43 +0100 Date: Mon, 12 Nov 2018 07:56:43 -0800 From: Sebastian Andrzej Siewior To: Borislav Petkov , x86@kernel.org Cc: Ingo Molnar , linux-kernel@vger.kernel.org, Andy Lutomirski , Paolo Bonzini , Radim =?utf-8?B?S3LEjW3DocWZ?= , kvm@vger.kernel.org, "Jason A. Donenfeld" , Rik van Riel , Dave Hansen Subject: [PATCH] x86/fpu: Disable BH while while loading FPU registers in __fpu__restore_sig() Message-ID: <20181112155643.vclej44qzg3pmbow@linutronix.de> References: <20181107194858.9380-1-bigeasy@linutronix.de> <20181107194858.9380-3-bigeasy@linutronix.de> <20181108145721.GC7543@zn.tnic> <20181109173521.2m6iijp5wkncgi77@linutronix.de> <20181109185202.GF21243@zn.tnic> <20181109232521.l2ll2n3coxygkxv4@linutronix.de> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline In-Reply-To: <20181109232521.l2ll2n3coxygkxv4@linutronix.de> User-Agent: NeoMutt/20180716 Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org The sequence fpu->initialized = 1; preempt_disable(); fpu__restore(fpu); preempt_enable(); is racy in regard to a context switch. A context switch after the first line would save the `actual' content of the FPU registers and trash away the state that has been prepared (since fpu__drop()). Use local_bh_disable() around the restore sequence to avoid the race. BH needs to be disabled because BH is allowed to run (even with preemption disabled) and might invoke kernel_fpu_begin(). This possible race has been reported by the Kernel Test Robot in FEB 2016 while there still was lazy FPU support. Link: https://lkml.kernel.org/r/20160226074940.GA28911@pd.tnic Cc: stable@vger.kernel.org Signed-off-by: Sebastian Andrzej Siewior --- arch/x86/kernel/fpu/signal.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/arch/x86/kernel/fpu/signal.c b/arch/x86/kernel/fpu/signal.c index 61a949d84dfa5..d99a8ee9e185e 100644 --- a/arch/x86/kernel/fpu/signal.c +++ b/arch/x86/kernel/fpu/signal.c @@ -344,10 +344,10 @@ static int __fpu__restore_sig(void __user *buf, void __user *buf_fx, int size) sanitize_restored_xstate(tsk, &env, xfeatures, fx_only); } + local_bh_disable(); fpu->initialized = 1; - preempt_disable(); fpu__restore(fpu); - preempt_enable(); + local_bh_enable(); return err; } else { -- 2.19.1