Commit 44cad52c authored by Andy Lutomirski's avatar Andy Lutomirski Committed by Borislav Petkov

x86/ptrace: Fix xfpregs_set()'s incorrect xmm clearing

xfpregs_set() handles 32-bit REGSET_XFP and 64-bit REGSET_FP. The actual
code treats these regsets as modern FX state (i.e. the beginning part of
XSTATE). The declarations of the regsets thought they were the legacy
i387 format. The code thought they were the 32-bit (no xmm8..15) variant
of XSTATE and, for good measure, made the high bits disappear by zeroing
the wrong part of the buffer. The latter broke ptrace, and everything
else confused anyone trying to understand the code. In particular, the
nonsense definitions of the regsets confused me when I wrote this code.

Clean this all up. Change the declarations to match reality (which
shouldn't change the generated code, let alone the ABI) and fix
xfpregs_set() to clear the correct bits and to only do so for 32-bit
callers.

Fixes: 6164331d ("x86/fpu: Rewrite xfpregs_set()")
Reported-by: default avatarLuís Ferreira <contact@lsferreira.net>
Signed-off-by: default avatarAndy Lutomirski <luto@kernel.org>
Signed-off-by: default avatarBorislav Petkov <bp@suse.de>
Cc: <stable@vger.kernel.org>
Link: https://bugzilla.kernel.org/show_bug.cgi?id=215524
Link: https://lore.kernel.org/r/YgpFnZpF01WwR8wU@zn.tnic
parent e5733d8c
...@@ -91,11 +91,9 @@ int xfpregs_set(struct task_struct *target, const struct user_regset *regset, ...@@ -91,11 +91,9 @@ int xfpregs_set(struct task_struct *target, const struct user_regset *regset,
const void *kbuf, const void __user *ubuf) const void *kbuf, const void __user *ubuf)
{ {
struct fpu *fpu = &target->thread.fpu; struct fpu *fpu = &target->thread.fpu;
struct user32_fxsr_struct newstate; struct fxregs_state newstate;
int ret; int ret;
BUILD_BUG_ON(sizeof(newstate) != sizeof(struct fxregs_state));
if (!cpu_feature_enabled(X86_FEATURE_FXSR)) if (!cpu_feature_enabled(X86_FEATURE_FXSR))
return -ENODEV; return -ENODEV;
...@@ -116,9 +114,10 @@ int xfpregs_set(struct task_struct *target, const struct user_regset *regset, ...@@ -116,9 +114,10 @@ int xfpregs_set(struct task_struct *target, const struct user_regset *regset,
/* Copy the state */ /* Copy the state */
memcpy(&fpu->fpstate->regs.fxsave, &newstate, sizeof(newstate)); memcpy(&fpu->fpstate->regs.fxsave, &newstate, sizeof(newstate));
/* Clear xmm8..15 */ /* Clear xmm8..15 for 32-bit callers */
BUILD_BUG_ON(sizeof(fpu->__fpstate.regs.fxsave.xmm_space) != 16 * 16); BUILD_BUG_ON(sizeof(fpu->__fpstate.regs.fxsave.xmm_space) != 16 * 16);
memset(&fpu->fpstate->regs.fxsave.xmm_space[8], 0, 8 * 16); if (in_ia32_syscall())
memset(&fpu->fpstate->regs.fxsave.xmm_space[8*4], 0, 8 * 16);
/* Mark FP and SSE as in use when XSAVE is enabled */ /* Mark FP and SSE as in use when XSAVE is enabled */
if (use_xsave()) if (use_xsave())
......
...@@ -1224,7 +1224,7 @@ static struct user_regset x86_64_regsets[] __ro_after_init = { ...@@ -1224,7 +1224,7 @@ static struct user_regset x86_64_regsets[] __ro_after_init = {
}, },
[REGSET_FP] = { [REGSET_FP] = {
.core_note_type = NT_PRFPREG, .core_note_type = NT_PRFPREG,
.n = sizeof(struct user_i387_struct) / sizeof(long), .n = sizeof(struct fxregs_state) / sizeof(long),
.size = sizeof(long), .align = sizeof(long), .size = sizeof(long), .align = sizeof(long),
.active = regset_xregset_fpregs_active, .regset_get = xfpregs_get, .set = xfpregs_set .active = regset_xregset_fpregs_active, .regset_get = xfpregs_get, .set = xfpregs_set
}, },
...@@ -1271,7 +1271,7 @@ static struct user_regset x86_32_regsets[] __ro_after_init = { ...@@ -1271,7 +1271,7 @@ static struct user_regset x86_32_regsets[] __ro_after_init = {
}, },
[REGSET_XFP] = { [REGSET_XFP] = {
.core_note_type = NT_PRXFPREG, .core_note_type = NT_PRXFPREG,
.n = sizeof(struct user32_fxsr_struct) / sizeof(u32), .n = sizeof(struct fxregs_state) / sizeof(u32),
.size = sizeof(u32), .align = sizeof(u32), .size = sizeof(u32), .align = sizeof(u32),
.active = regset_xregset_fpregs_active, .regset_get = xfpregs_get, .set = xfpregs_set .active = regset_xregset_fpregs_active, .regset_get = xfpregs_get, .set = xfpregs_set
}, },
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment