Commit 9301982c authored by Thomas Gleixner's avatar Thomas Gleixner Committed by Borislav Petkov
Browse files

x86/fpu: Preserve supervisor states in sanitize_restored_user_xstate() 



sanitize_restored_user_xstate() preserves the supervisor states only
when the fx_only argument is zero, which allows unprivileged user space
to put supervisor states back into init state.

Preserve them unconditionally.

 [ bp: Fix a typo or two in the text. ]

Fixes: 5d6b6a6f ("x86/fpu/xstate: Update sanitize_restored_xstate() for supervisor xstates")
Signed-off-by: default avatarThomas Gleixner <tglx@linutronix.de>
Signed-off-by: default avatarBorislav Petkov <bp@suse.de>
Cc: stable@vger.kernel.org
Link: https://lkml.kernel.org/r/20210618143444.438635017@linutronix.de
parent 13311e74

arch/x86/kernel/fpu/signal.c

+8 −18
Original line number Diff line number Diff line
@@ -221,28 +221,18 @@ sanitize_restored_user_xstate(union fpregs_state *state, 


	if (use_xsave()) {

		/*

		 * Note: we don't need to zero the reserved bits in the

		 * xstate_header here because we either didn't copy them at all,

		 * or we checked earlier that they aren't set.

		 * Clear all feature bits which are not set in

		 * user_xfeatures and clear all extended features

		 * for fx_only mode.

		 */

		u64 mask = fx_only ? XFEATURE_MASK_FPSSE : user_xfeatures;



		/*

		 * 'user_xfeatures' might have bits clear which are

		 * set in header->xfeatures. This represents features that

		 * were in init state prior to a signal delivery, and need

		 * to be reset back to the init state.  Clear any user

		 * feature bits which are set in the kernel buffer to get

		 * them back to the init state.

		 *

		 * Supervisor state is unchanged by input from userspace.

		 * Ensure supervisor state bits stay set and supervisor

		 * state is not modified.

		 * Supervisor state has to be preserved. The sigframe

		 * restore can only modify user features, i.e. @mask

		 * cannot contain them.

		 */

		if (fx_only)

			header->xfeatures = XFEATURE_MASK_FPSSE;

		else

			header->xfeatures &= user_xfeatures |

					     xfeatures_mask_supervisor();

		header->xfeatures &= mask | xfeatures_mask_supervisor();

	}



	if (use_fxsr()) {