linux/arch/x86/mm
Eric Biggers d5c8028b47 x86/fpu: Reinitialize FPU registers if restoring FPU state fails
Userspace can change the FPU state of a task using the ptrace() or
rt_sigreturn() system calls.  Because reserved bits in the FPU state can
cause the XRSTOR instruction to fail, the kernel has to carefully
validate that no reserved bits or other invalid values are being set.

Unfortunately, there have been bugs in this validation code.  For
example, we were not checking that the 'xcomp_bv' field in the
xstate_header was 0.  As-is, such bugs are exploitable to read the FPU
registers of other processes on the system.  To do so, an attacker can
create a task, assign to it an invalid FPU state, then spin in a loop
and monitor the values of the FPU registers.  Because the task's FPU
registers are not being restored, sometimes the FPU registers will have
the values from another process.

This is likely to continue to be a problem in the future because the
validation done by the CPU instructions like XRSTOR is not immediately
visible to kernel developers.  Nor will invalid FPU states ever be
encountered during ordinary use --- they will only be seen during
fuzzing or exploits.  There can even be reserved bits outside the
xstate_header which are easy to forget about.  For example, the MXCSR
register contains reserved bits, which were not validated by the
KVM_SET_XSAVE ioctl until commit a575813bfe ("KVM: x86: Fix load
damaged SSEx MXCSR register").

Therefore, mitigate this class of vulnerability by restoring the FPU
registers from init_fpstate if restoring from the task's state fails.

We actually used to do this, but it was (perhaps unwisely) removed by
commit 9ccc27a5d2 ("x86/fpu: Remove error return values from
copy_kernel_to_*regs() functions").  This new patch is also a bit
different.  First, it only clears the registers, not also the bad
in-memory state; this is simpler and makes it easier to make the
mitigation cover all callers of __copy_kernel_to_fpregs().  Second, it
does the register clearing in an exception handler so that no extra
instructions are added to context switches.  In fact, we *remove*
instructions, since previously we were always zeroing the register
containing 'err' even if CONFIG_X86_DEBUG_FPU was disabled.

Signed-off-by: Eric Biggers <ebiggers@google.com>
Reviewed-by: Rik van Riel <riel@redhat.com>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Andy Lutomirski <luto@amacapital.net>
Cc: Andy Lutomirski <luto@kernel.org>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Dave Hansen <dave.hansen@linux.intel.com>
Cc: Dmitry Vyukov <dvyukov@google.com>
Cc: Eric Biggers <ebiggers3@gmail.com>
Cc: Fenghua Yu <fenghua.yu@intel.com>
Cc: Kevin Hao <haokexin@gmail.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Michael Halcrow <mhalcrow@google.com>
Cc: Oleg Nesterov <oleg@redhat.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Wanpeng Li <wanpeng.li@hotmail.com>
Cc: Yu-cheng Yu <yu-cheng.yu@intel.com>
Cc: kernel-hardening@lists.openwall.com
Link: http://lkml.kernel.org/r/20170922174156.16780-4-ebiggers3@gmail.com
Link: http://lkml.kernel.org/r/20170923130016.21448-27-mingo@kernel.org
Signed-off-by: Ingo Molnar <mingo@kernel.org>
2017-09-25 09:26:38 +02:00
..
kmemcheck x86/mm: Audit and remove any unnecessary uses of module.h 2016-07-14 13:04:20 +02:00
amdtopology.c x86/boot/e820: Move asm/e820.h to asm/e820/api.h 2017-01-28 09:31:13 +01:00
debug_pagetables.c x86/mm/ptdump: Make (debugfs)/kernel_page_tables read-only 2015-12-04 12:55:01 +01:00
dump_pagetables.c x86/mm/dump_pagetables: Speed up page tables dump for CONFIG_KASAN=y 2017-07-25 11:22:09 +02:00
extable.c x86/fpu: Reinitialize FPU registers if restoring FPU state fails 2017-09-25 09:26:38 +02:00
fault.c Merge branch 'x86-apic-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip 2017-09-04 17:43:56 -07:00
highmem_32.c x86/mm: Audit and remove any unnecessary uses of module.h 2016-07-14 13:04:20 +02:00
hugetlbpage.c x86/mm: Prepare to expose larger address space to userspace 2017-07-21 10:05:18 +02:00
ident_map.c x86/mm, kexec: Allow kexec to be used with SME 2017-07-18 11:38:04 +02:00
init_32.c mm, memory_hotplug: replace for_device by want_memblock in arch_add_memory 2017-07-06 16:24:32 -07:00
init_64.c mm/memory_hotplug: introduce add_pages 2017-09-08 18:26:46 -07:00
init.c x86/mm/64: Initialize CR4.PCIDE early 2017-09-13 09:54:43 +02:00
iomap_32.c x86/mm: Audit and remove any unnecessary uses of module.h 2016-07-14 13:04:20 +02:00
ioremap.c x86/mm: Use proper encryption attributes with /dev/mem 2017-07-18 11:38:05 +02:00
kasan_init_64.c x86/mm: Insure that boot memory areas are mapped properly 2017-07-18 11:38:01 +02:00
kaslr.c x86/mm: Add support for 5-level paging for KASLR 2017-06-13 08:56:58 +02:00
kmmio.c x86/mm: Audit and remove any unnecessary uses of module.h 2016-07-14 13:04:20 +02:00
Makefile x86/mm: Add support to encrypt the kernel in-place 2017-07-18 11:38:05 +02:00
mem_encrypt_boot.S x86/mm: Fix SME encryption stack ptr handling 2017-08-29 10:57:16 +02:00
mem_encrypt.c x86/mm: Make the SME mask a u64 2017-09-07 11:53:11 +02:00
mm_internal.h x86: Enable PAT to use cache mode translation tables 2014-11-16 11:04:26 +01:00
mmap.c Merge branch 'linus' into x86/mm to pick up fixes and to fix conflicts 2017-08-26 09:19:13 +02:00
mmio-mod.c x86/boot/e820: Move asm/e820.h to asm/e820/api.h 2017-01-28 09:31:13 +01:00
mpx.c x86/mpx: Do not allow MPX if we have mappings above 47-bit 2017-07-21 10:05:18 +02:00
numa_32.c x86/mm/32: Set the '__vmalloc_start_set' flag in initmem_init() 2017-05-09 08:12:27 +02:00
numa_64.c
numa_emulation.c x86/numa_emulation: Recalculate numa_nodes_parsed from emulated nodes 2017-07-18 11:16:49 +02:00
numa_internal.h x86-32, mm: Rip out x86_32 NUMA remapping code 2013-01-31 14:12:30 -08:00
numa.c Merge branch 'x86/boot' into x86/mm, to avoid conflict 2017-04-11 08:56:05 +02:00
pageattr-test.c x86/mm/pat: Make mm/pageattr[-test].c explicitly non-modular 2015-08-25 09:48:38 +02:00
pageattr.c x86, drm, fbdev: Do not specify encrypted memory for video mappings 2017-07-18 11:38:04 +02:00
pat_internal.h x86/mm/pat: Convert to pr_*() usage 2015-05-27 14:40:59 +02:00
pat_rbtree.c x86/mm/pat: Use rb_entry() 2017-02-04 17:18:00 +01:00
pat.c x86/mm: Use proper encryption attributes with /dev/mem 2017-07-18 11:38:05 +02:00
pf_in.c x86/mm: Audit and remove any unnecessary uses of module.h 2016-07-14 13:04:20 +02:00
pf_in.h
pgtable_32.c Merge branch 'x86/boot' into x86/mm, to avoid conflict 2017-04-11 08:56:05 +02:00
pgtable.c x86/paravirt: Remove no longer used paravirt functions 2017-09-13 10:55:15 +02:00
physaddr.c x86/mm: Audit and remove any unnecessary uses of module.h 2016-07-14 13:04:20 +02:00
physaddr.h
pkeys.c x86/fpu: Change fpu->fpregs_active users to fpu->fpstate_active 2017-09-24 13:04:34 +02:00
setup_nx.c Revert "x86/mm/32: Set NX in __supported_pte_mask before enabling paging" 2016-04-26 19:52:57 +02:00
srat.c x86/boot/e820: Move asm/e820.h to asm/e820/api.h 2017-01-28 09:31:13 +01:00
testmmiotrace.c Annotate hardware config module parameters in arch/x86/mm/ 2017-04-04 16:54:21 +01:00
tlb.c x86/mm: Get rid of VM_BUG_ON in switch_tlb_irqs_off() 2017-09-13 09:50:52 +02:00