Commit e9949bb2 authored Feb 27, 2023 by Chang S. Bae Committed by Lin Wang May 23, 2023

x86/fpu/xstate: Prevent false-positive warning in __copy_xstate_uabi_buf()

mainline inclusion
from mainline-v6.3-rc4
commit b1588884
category: bugfix
bugzilla: https://gitee.com/openeuler/intel-kernel/issues/I73H0T
CVE: NA

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=b15888840207c2bfe678dd1f68a32db54315e71f



Intel-SIG: commit b1588884 x86/fpu/xstate: Prevent false-positive
warning in __copy_xstate_uabi_buf().

--------------------------------

__copy_xstate_to_uabi_buf() copies either from the tasks XSAVE buffer
or from init_fpstate into the ptrace buffer. Dynamic features, like
XTILEDATA, have an all zeroes init state and are not saved in
init_fpstate, which means the corresponding bit is not set in the
xfeatures bitmap of the init_fpstate header.

But __copy_xstate_to_uabi_buf() retrieves addresses for both the tasks
xstate and init_fpstate unconditionally via __raw_xsave_addr().

So if the tasks XSAVE buffer has a dynamic feature set, then the
address retrieval for init_fpstate triggers the warning in
__raw_xsave_addr() which checks the feature bit in the init_fpstate
header.

Remove the address retrieval from init_fpstate for extended features.
They have an all zeroes init state so init_fpstate has zeros for them.
Then zeroing the user buffer for the init state is the same as copying
them from init_fpstate.

Fixes: 2308ee57 ("x86/fpu/amx: Enable the AMX feature in 64-bit mode")
Reported-by: Mingwei Zhang <mizhang@google.com>
Link: https://lore.kernel.org/kvm/20230221163655.920289-2-mizhang@google.com/


Signed-off-by: Chang S. Bae <chang.seok.bae@intel.com>
Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
Tested-by: Mingwei Zhang <mizhang@google.com>
Link: https://lore.kernel.org/all/20230227210504.18520-2-chang.seok.bae%40intel.com


Cc: stable@vger.kernel.org
Signed-off-by: Lin Wang <lin.x.wang@intel.com>

parent d162559f

arch/x86/kernel/fpu/xstate.c

+14 −16

Original line number	Diff line number	Diff line
		@@ -1100,21 +1100,20 @@ void __copy_xstate_to_uabi_buf(struct membuf to, struct fpstate *fpstate,
		zerofrom = offsetof(struct xregs_state, extended_state_area);

		/*
		* The ptrace buffer is in non-compacted XSAVE format. In
		* non-compacted format disabled features still occupy state space,
		* but there is no state to copy from in the compacted
		* init_fpstate. The gap tracking will zero these states.
		*/
		mask = fpstate->user_xfeatures;

		/*
		* Dynamic features are not present in init_fpstate. When they are
		* in an all zeros init state, remove those from 'mask' to zero
		* those features in the user buffer instead of retrieving them
		* from init_fpstate.
		* This 'mask' indicates which states to copy from fpstate.
		* Those extended states that are not present in fpstate are
		* either disabled or initialized:
		*
		* In non-compacted format, disabled features still occupy
		* state space but there is no state to copy from in the
		* compacted init_fpstate. The gap tracking will zero these
		* states.
		*
		* The extended features have an all zeroes init state. Thus,
		* remove them from 'mask' to zero those features in the user
		* buffer instead of retrieving them from init_fpstate.
		*/
		if (fpu_state_size_dynamic())
		mask &= (header.xfeatures \| xinit->header.xcomp_bv);
		mask = header.xfeatures;

		for_each_extended_xfeature(i, mask) {
		/*
		@@ -1133,9 +1132,8 @@ void __copy_xstate_to_uabi_buf(struct membuf to, struct fpstate *fpstate,
		pkru.pkru = pkru_val;
		membuf_write(&to, &pkru, sizeof(pkru));
		} else {
		copy_feature(header.xfeatures & BIT_ULL(i), &to,
		membuf_write(&to,
		__raw_xsave_addr(xsave, i),
		__raw_xsave_addr(xinit, i),
		xstate_sizes[i]);
		}
		/*