From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-oa1-f73.google.com (mail-oa1-f73.google.com [209.85.160.73]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A6FEA6FC3 for ; Wed, 29 Apr 2026 00:06:31 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.160.73 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1777421193; cv=none; b=UmEIXEbIcUstk4MdfthajxpLuIGbaMXDMMhq0wdcMJZFkNSsOCPTzRwKqpW7GzUzRfS9FJmIlGcNc5aks5Cq73xZ1vAKryxTuC4veGpx0jYLP5SEUZC1LzilgU8skN487XkRZq54dRb6a0FoDHQCwzP/ULum2FTVHdTTvOHJtgE= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1777421193; c=relaxed/simple; bh=n0dBxv61kgCZiP6/pcNg8V2oL7fpjyJjwNl78oEnzwU=; h=Date:Mime-Version:Message-ID:Subject:From:To:Cc:Content-Type; b=btp6cHjb/VsW4QW4ZWQjJ6EqdygYtE/u+qcluG+ZdTVUsRBUrWQO8yhDe+fA8KTZvIeHXihrkVOoCG14ApdyTVb6GNftGZToPvrIXXNSX9SVyVi8MMy3wLErBdHtfe0v9euUuFp3eiAQrP8IQCnTVNlLsqBAhPl7fu8TDYbiDTw= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=flex--avagin.bounces.google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=GRvKsShs; arc=none smtp.client-ip=209.85.160.73 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--avagin.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="GRvKsShs" Received: by mail-oa1-f73.google.com with SMTP id 586e51a60fabf-42c125431f7so15204459fac.3 for ; Tue, 28 Apr 2026 17:06:31 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20251104; t=1777421190; x=1778025990; darn=vger.kernel.org; h=cc:to:from:subject:message-id:mime-version:date:from:to:cc:subject :date:message-id:reply-to; bh=6FW+L3ubugl0QdPcOsaUMl+x/158JR6QuBxGAIT9xVs=; b=GRvKsShsmflt7T6+Kf81aO+y6ca2i0Y4KIGWtxy30IS8A6bm3Yqbxzjrka1/P3rYBH tR62JUnFRbk8yCWTEcawEQV6j6nx4YsgulR80v7VuioFXLO6C+puUQAO9fhcXHvbwbfg +QUk1yrGK7wFqQefth5dCQ3ffVHPIH0QPN5PMsdWaOB7NThadO3FJtWtgz/uKo/PRkwQ eg6mRsXm9yMb+OnVevi8pQtYNnMgEPeUNWKxPij/NYzkkOBOqApjFhGuN4Nh7KqEAszu LS057BxN9p5g1AIbGoj3Og60z0X8NS6C0MpHkAuS+u6erAtmwLyu245eY2Keyie+uCcQ VB5w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1777421190; x=1778025990; h=cc:to:from:subject:message-id:mime-version:date:x-gm-message-state :from:to:cc:subject:date:message-id:reply-to; bh=6FW+L3ubugl0QdPcOsaUMl+x/158JR6QuBxGAIT9xVs=; b=d5ZDfbNxVZAC+wzeiNqIduUJ3UlwC7HcAyPbpVD7TGcJKXIShwjQyjEreC2l+XQ0fy acSGorbqh1/DVrXpwmHr7Ad3hSFW2pK5owfLQiqUxYxhL8l539lAIiZvez5PjA4V4Tg6 KaemUsbApbpt7sP38zH3gtPkfBOntIrOlcSG5F7rbd3xq4S1/kVK3OfntPrui4tu5nAm BXLuBoCC3nuD2NhE9Y+RwEXughewI036BwJr3Jllqw8G6dwsba0VLnmV5b6BtfRVQ/qu zEgVxiclXamoT8XFFc0i67uaj9uQv6L10cWsybHNFkbAhG+bWrCbw9fkp/6PjMGbm7bR S9XQ== X-Gm-Message-State: AOJu0YyPIAun5exJxENmKkxvaQgzTRXLBTTc8vmw7bZ3O8+LTFeh4gk+ xq7r0BZacnKFyJCCaVRu/bayXAPOhwaeAf5L7Nlo9V1lhiOdTMv7zSVtjug8m+6bDzp6U1uNWq3 KppBiWg== X-Received: from ilut10.prod.google.com ([2002:a05:6e02:160a:b0:4fc:4c72:e6cc]) (user=avagin job=prod-delivery.src-stubby-dispatcher) by 2002:a05:6820:a0b:b0:696:22dc:b4db with SMTP id 006d021491bc7-696684c23afmr946678eaf.41.1777421190478; Tue, 28 Apr 2026 17:06:30 -0700 (PDT) Date: Wed, 29 Apr 2026 00:06:23 +0000 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 X-Mailer: git-send-email 2.54.0.545.g6539524ca2-goog Message-ID: <20260429000623.3356606-1-avagin@google.com> Subject: [PATCH] Revert "x86/fpu: Refine and simplify the magic number check during signal return" From: Andrei Vagin To: Thomas Gleixner , Ingo Molnar , Borislav Petkov , Dave Hansen Cc: linux-kernel@vger.kernel.org, criu@lists.linux.dev, x86@kernel.org, Andrei Vagin , "Chang S. Bae" , stable@vger.kernel.org Content-Type: text/plain; charset="UTF-8" This reverts commit dc8aa31a7ac2 ("x86/fpu: Refine and simplify the magic number check during signal return"). The reverted commit broke applications that construct signal frames in userspace (such as CRIU and gVisor) if the frame's xstate size is smaller than the kernel's fpstate->user_size. Furthermore, this introduces a critical issue for checkpoint/restore tools like CRIU. If a process is checkpointed while inside a signal handler, its stack contains a signal frame formatted according to the source host's xstate capabilities. If that process is later restored on a destination host with larger xstate capabilities (e.g., a newer CPU with more features enabled, resulting in a larger fpstate->user_size), the kernel will look for FP_XSTATE_MAGIC2 at the destination host's larger user_size offset instead of the offset encoded in the frame's fx_sw->xstate_size. This causes the magic2 check to fail, forcing sigreturn to silently fall back to "FX-only" mode. Upon return from the signal handler, the process's extended state is reset to initial values instead of being restored, leading to silent data corruption. The original commit cited commit d877550eaf2d ("x86/fpu: Stop relying on userspace for info to fault in xsave buffer") as justification to stop relying on userspace for the magic number check. However, these two changes are fundamentally different. The last one only changed how much memory the kernel ensures is paged-in before running XRSTOR to prevent an infinite loop. It did not change the signal frame format or how the layout is validated. Reverting this change restores the use of fx_sw->xstate_size for locating magic2 and restores the necessary sanity checks, ensuring that the signal frame remains self-describing and portable. Cc: Chang S. Bae Cc: stable@vger.kernel.org Fixes: dc8aa31a7ac2 ("x86/fpu: Refine and simplify the magic number check during signal return") Signed-off-by: Andrei Vagin --- arch/x86/kernel/fpu/signal.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/arch/x86/kernel/fpu/signal.c b/arch/x86/kernel/fpu/signal.c index c3ec2512f2bb..20b638c507ca 100644 --- a/arch/x86/kernel/fpu/signal.c +++ b/arch/x86/kernel/fpu/signal.c @@ -27,14 +27,19 @@ static inline bool check_xstate_in_sigframe(struct fxregs_state __user *fxbuf, struct _fpx_sw_bytes *fx_sw) { + int min_xstate_size = sizeof(struct fxregs_state) + + sizeof(struct xstate_header); void __user *fpstate = fxbuf; unsigned int magic2; if (__copy_from_user(fx_sw, &fxbuf->sw_reserved[0], sizeof(*fx_sw))) return false; - /* Check for the first magic field */ - if (fx_sw->magic1 != FP_XSTATE_MAGIC1) + /* Check for the first magic field and other error scenarios. */ + if (fx_sw->magic1 != FP_XSTATE_MAGIC1 || + fx_sw->xstate_size < min_xstate_size || + fx_sw->xstate_size > x86_task_fpu(current)->fpstate->user_size || + fx_sw->xstate_size > fx_sw->extended_size) goto setfx; /* @@ -43,7 +48,7 @@ static inline bool check_xstate_in_sigframe(struct fxregs_state __user *fxbuf, * fpstate layout with out copying the extended state information * in the memory layout. */ - if (__get_user(magic2, (__u32 __user *)(fpstate + x86_task_fpu(current)->fpstate->user_size))) + if (__get_user(magic2, (__u32 __user *)(fpstate + fx_sw->xstate_size))) return false; if (likely(magic2 == FP_XSTATE_MAGIC2)) -- 2.54.0.545.g6539524ca2-goog