Re: SETFPXREGS fix

[Gareth Hughes <gareth@valinux.com>]

Andrea Arcangeli wrote:
> 
> --- 2.4.0-test10/arch/i386/kernel/i387.c        Thu Nov  2 20:58:58 2000
> +++ PIII/arch/i386/kernel/i387.c        Thu Nov  2 18:44:36 2000
> @@ -440,8 +436,25 @@
>  int set_fpxregs( struct task_struct *tsk, struct user_fxsr_struct *buf )
>  {
>         if ( HAVE_FXSR ) {
> -               __copy_from_user( &tsk->thread.i387.fxsave, (void *)buf,
> -                                 sizeof(struct user_fxsr_struct) );
> +               long mxcsr;
> +
> +               if (__copy_from_user(&tsk->thread.i387.fxsave, (void *)buf,
> +                                    (long) &((struct user_fxsr_struct *)
> +                                             0)->mxcsr))
> +                       return -EFAULT;
> +               if (__get_user(mxcsr,
> +                              &((struct user_fxsr_struct *) buf)->mxcsr))
> +                       return -EFAULT;
> +               /* bit 6 and 31-16 must be zero for security reasons */
> +               mxcsr &= 0xffbf;
> +               tsk->thread.i387.fxsave.mxcsr = mxcsr;
> +               if (__copy_from_user(&tsk->thread.i387.fxsave.reserved,
> +                                    &((struct user_fxsr_struct *)
> +                                      buf)->reserved,
> +                                    sizeof(struct user_fxsr_struct)-
> +                                    (long) &((struct user_fxsr_struct *)
> +                                             0)->reserved))
> +                       return -EFAULT;
>                 return 0;
>         } else {
>                 return -EIO;

Why do all three copies?  Why not copy it once and mask out the mxcsr
value when it's in tsk->thread.i387.fxsave.mxcsr?  Seems to be an overly
complex fix.

	if ( HAVE_FXSR ) {
		if ( __copy_from_user( &tsk->thread.i387.fxsave, (void *)buf,
					sizeof(struct user_fxsr_struct) ) )
			return -EFAULT;
		/* bit 6 and 31-16 must be zero for security reasons */
		tsk->thread.i387.fxsave.mxcsr &= 0x0000ffbf;
		return 0;
	}

-- Gareth
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
Please read the FAQ at http://www.tux.org/lkml/