kernel-hardening.lists.openwall.com archive mirror
 help / color / mirror / Atom feed
* [kernel-hardening] [PATCH v2 0/3] x86/fpu: prevent leaking FPU registers via invalid FPU state
@ 2017-09-20  0:44 Eric Biggers
  2017-09-20  0:44 ` [kernel-hardening] [PATCH v2 1/3] x86/fpu: don't let userspace set bogus xcomp_bv Eric Biggers
                   ` (3 more replies)
  0 siblings, 4 replies; 11+ messages in thread
From: Eric Biggers @ 2017-09-20  0:44 UTC (permalink / raw)
  To: x86
  Cc: linux-kernel, kernel-hardening, Andy Lutomirski, Dave Hansen,
	Dmitry Vyukov, Fenghua Yu, Ingo Molnar, Kevin Hao, Oleg Nesterov,
	Wanpeng Li, Yu-cheng Yu, Michael Halcrow, Eric Biggers

From: Eric Biggers <ebiggers@google.com>

This is a second attempt to fix the bug found by syzkaller where the
ptrace syscall can be used to set invalid bits in a task's FPU state.
I also found that an equivalent bug was reachable using the sigreturn
syscall, so the first patch fixes the bug in both cases.

The other two patches start validating the other parts of the
xstate_header and make it so that invalid FPU states can no longer be
abused to leak the FPU registers of other processes.

Eric Biggers (3):
  x86/fpu: don't let userspace set bogus xcomp_bv
  x86/fpu: tighten validation of user-supplied xstate_header
  x86/fpu: reinitialize FPU registers if restoring FPU state fails

 arch/x86/include/asm/fpu/internal.h | 29 ++++++++++++++++++++---------
 arch/x86/include/asm/fpu/xstate.h   | 19 +++++++++++++++++++
 arch/x86/kernel/fpu/core.c          | 16 ++++++++++++++++
 arch/x86/kernel/fpu/regset.c        | 20 +++++++++-----------
 arch/x86/kernel/fpu/signal.c        | 15 +++++++++++----
 arch/x86/kernel/fpu/xstate.c        | 27 ++++++++++-----------------
 6 files changed, 85 insertions(+), 41 deletions(-)

-- 
2.14.1.690.gbb1197296e-goog

^ permalink raw reply	[flat|nested] 11+ messages in thread

end of thread, other threads:[~2017-09-26  3:02 UTC | newest]

Thread overview: 11+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2017-09-20  0:44 [kernel-hardening] [PATCH v2 0/3] x86/fpu: prevent leaking FPU registers via invalid FPU state Eric Biggers
2017-09-20  0:44 ` [kernel-hardening] [PATCH v2 1/3] x86/fpu: don't let userspace set bogus xcomp_bv Eric Biggers
2017-09-26  2:15   ` [kernel-hardening] [lkp-robot] [x86/fpu] 14e633085a: Kernel_panic-not_syncing:Attempted_to_kill_init!exitcode= kernel test robot
2017-09-26  3:02     ` [kernel-hardening] " Eric Biggers
2017-09-20  0:44 ` [kernel-hardening] [PATCH v2 2/3] x86/fpu: tighten validation of user-supplied xstate_header Eric Biggers
2017-09-20 15:54   ` [kernel-hardening] " Dave Hansen
2017-09-20  0:44 ` [kernel-hardening] [PATCH v2 3/3] x86/fpu: reinitialize FPU registers if restoring FPU state fails Eric Biggers
2017-09-20  3:18   ` [kernel-hardening] " Eric Biggers
2017-09-20 15:41   ` Andy Lutomirski
2017-09-22 17:05   ` kbuild test robot
2017-09-20  3:03 ` [kernel-hardening] Re: [PATCH v2 0/3] x86/fpu: prevent leaking FPU registers via invalid FPU state Kees Cook

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).