• Borislav Petkov's avatar
    x86/fpu: Load xsave pointer *after* initialization · 18ecb3bf
    Borislav Petkov authored
    So I was playing with gdb today and did this simple thing:
    
    	gdb /bin/ls
    
    	...
    
    	(gdb) run
    
    Box exploded with this splat:
    
    	BUG: unable to handle kernel NULL pointer dereference at 00000000000001d0
    	IP: [<ffffffff8100fe5a>] xstateregs_get+0x7a/0x120
    	[...]
    
    	Call Trace:
    	 ptrace_regset
    	 ptrace_request
    	 ? wait_task_inactive
    	 ? preempt_count_sub
    	 arch_ptrace
    	 ? ptrace_get_task_struct
    	 SyS_ptrace
    	 system_call_fastpath
    
    ... because we do cache &target->thread.fpu.state->xsave into the
    local variable xsave but that pointer is NULL at that time and
    it gets initialized later, in init_fpu(), see:
    
    	e7f180dc ("x86/fpu: Change xstateregs_get()/set() to use ->xsave.i387 rather than ->fxsave")
    
    The fix is simple: load xsave *after* init_fpu() has run.
    
    Also do the same in xstateregs_set(), as suggested by Oleg Nesterov.
    Signed-off-by: default avatarBorislav Petkov <bp@suse.de>
    Acked-by: default avatarOleg Nesterov <oleg@redhat.com>
    Cc: Andy Lutomirski <luto@amacapital.net>
    Cc: H. Peter Anvin <hpa@zytor.com>
    Cc: Linus Torvalds <torvalds@linux-foundation.org>
    Cc: Rik van Riel <riel@redhat.com>
    Cc: Tavis Ormandy <taviso@google.com>
    Cc: Thomas Gleixner <tglx@linutronix.de>
    Link: http://lkml.kernel.org/r/1429209697-5902-1-git-send-email-bp@alien8.deSigned-off-by: default avatarIngo Molnar <mingo@kernel.org>
    18ecb3bf
i387.c 14.8 KB