From nobody Mon Jun 29 07:27:49 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 36CE3C433EF for ; Mon, 14 Feb 2022 12:05:57 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S244456AbiBNMGD (ORCPT ); Mon, 14 Feb 2022 07:06:03 -0500 Received: from mxb-00190b01.gslb.pphosted.com ([23.128.96.19]:35462 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S231465AbiBNMGB (ORCPT ); Mon, 14 Feb 2022 07:06:01 -0500 Received: from mail.skyhub.de (mail.skyhub.de [5.9.137.197]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id EE15B2706 for ; Mon, 14 Feb 2022 04:05:53 -0800 (PST) Received: from zn.tnic (dslb-088-067-221-104.088.067.pools.vodafone-ip.de [88.67.221.104]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.skyhub.de (SuperMail on ZX Spectrum 128k) with ESMTPSA id 5BD531EC01A8; Mon, 14 Feb 2022 13:05:48 +0100 (CET) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=alien8.de; s=dkim; t=1644840348; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding:in-reply-to: references; bh=Q2WswK2aoG0dYxQGFY7WgUEOKE8aFownjry5ISfZCc4=; b=k66/h/tJtagFjbu2XaQqtQ0jqiMPjqSy6JQQgxkw4Rhax2OR1lpeiTstV4ozpf3nZKTm5N 09YTwBNdCLBMLRXIgaef3mySZi4SsNybw7MXEUr+aFxSoxO8AVBmPuN0EXlSJyZgSM0uqE um1zGHN6ttnFiPEJmL6nUJOra64wCkg= Date: Mon, 14 Feb 2022 13:05:49 +0100 From: Borislav Petkov To: Andy Lutomirski , =?utf-8?B?THXDrXM=?= Ferreira Cc: x86-ml , lkml Subject: [PATCH] x86/ptrace: Fix xfpregs_set()'s incorrect xmm clearing Message-ID: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Disposition: inline Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Lemme send it out as Luto looks busy. If there are no complaints I'll queue it in a couple of days... Thx. Reported-by: Lu=C3=ADs Ferreira --- From: Andy Lutomirski Date: Mon, 31 Jan 2022 12:38:47 -0800 Subject: [PATCH] x86/ptrace: Fix xfpregs_set()'s incorrect xmm clearing MIME-Version: 1.0 Content-Type: text/plain; charset=3DUTF-8 Content-Transfer-Encoding: 8bit xfpregs_set() handles 32-bit REGSET_XFP and 64-bit REGSET_FP. The actual code treats these regsets as modern FX state (i.e. the beginning part of XSTATE). The declarations of the regsets thought they were the legacy i387 format. The code thought they were the 32-bit (no xmm8..15) variant of XSTATE and, for good measure, made the high bits disappear by zeroing the wrong part of the buffer. The latter broke ptrace, and everything else confused anyone trying to understand the code. In particular, the nonsense definitions of the regsets confused me when I wrote this code. Clean this all up. Change the declarations to match reality (which shouldn't change the generated code, let alone the ABI) and fix xfpregs_set() to clear the correct bits and to only do so for 32-bit callers. Fixes: 6164331d15f7 ("x86/fpu: Rewrite xfpregs_set()") Reported-by: Lu=C3=ADs Ferreira Signed-off-by: Andy Lutomirski Signed-off-by: Borislav Petkov Link: https://bugzilla.kernel.org/show_bug.cgi?id=3D215524 --- arch/x86/kernel/fpu/regset.c | 9 ++++----- arch/x86/kernel/ptrace.c | 4 ++-- 2 files changed, 6 insertions(+), 7 deletions(-) diff --git a/arch/x86/kernel/fpu/regset.c b/arch/x86/kernel/fpu/regset.c index 437d7c930c0b..75ffaef8c299 100644 --- a/arch/x86/kernel/fpu/regset.c +++ b/arch/x86/kernel/fpu/regset.c @@ -91,11 +91,9 @@ int xfpregs_set(struct task_struct *target, const struct= user_regset *regset, const void *kbuf, const void __user *ubuf) { struct fpu *fpu =3D &target->thread.fpu; - struct user32_fxsr_struct newstate; + struct fxregs_state newstate; int ret; =20 - BUILD_BUG_ON(sizeof(newstate) !=3D sizeof(struct fxregs_state)); - if (!cpu_feature_enabled(X86_FEATURE_FXSR)) return -ENODEV; =20 @@ -116,9 +114,10 @@ int xfpregs_set(struct task_struct *target, const stru= ct user_regset *regset, /* Copy the state */ memcpy(&fpu->fpstate->regs.fxsave, &newstate, sizeof(newstate)); =20 - /* Clear xmm8..15 */ + /* Clear xmm8..15 for 32-bit callers */ BUILD_BUG_ON(sizeof(fpu->__fpstate.regs.fxsave.xmm_space) !=3D 16 * 16); - memset(&fpu->fpstate->regs.fxsave.xmm_space[8], 0, 8 * 16); + if (in_ia32_syscall()) + memset(&fpu->fpstate->regs.fxsave.xmm_space[8*4], 0, 8 * 16); =20 /* Mark FP and SSE as in use when XSAVE is enabled */ if (use_xsave()) diff --git a/arch/x86/kernel/ptrace.c b/arch/x86/kernel/ptrace.c index 6d2244c94799..8d2f2f995539 100644 --- a/arch/x86/kernel/ptrace.c +++ b/arch/x86/kernel/ptrace.c @@ -1224,7 +1224,7 @@ static struct user_regset x86_64_regsets[] __ro_after= _init =3D { }, [REGSET_FP] =3D { .core_note_type =3D NT_PRFPREG, - .n =3D sizeof(struct user_i387_struct) / sizeof(long), + .n =3D sizeof(struct fxregs_state) / sizeof(long), .size =3D sizeof(long), .align =3D sizeof(long), .active =3D regset_xregset_fpregs_active, .regset_get =3D xfpregs_get, .= set =3D xfpregs_set }, @@ -1271,7 +1271,7 @@ static struct user_regset x86_32_regsets[] __ro_after= _init =3D { }, [REGSET_XFP] =3D { .core_note_type =3D NT_PRXFPREG, - .n =3D sizeof(struct user32_fxsr_struct) / sizeof(u32), + .n =3D sizeof(struct fxregs_state) / sizeof(u32), .size =3D sizeof(u32), .align =3D sizeof(u32), .active =3D regset_xregset_fpregs_active, .regset_get =3D xfpregs_get, .= set =3D xfpregs_set }, --=20 2.29.2 --=20 Regards/Gruss, Boris. https://people.kernel.org/tglx/notes-about-netiquette