• Thomas Gleixner's avatar
    x86/fpu: Sanitize xstateregs_set() · 43be46e8
    Thomas Gleixner authored
    xstateregs_set() operates on a stopped task and tries to copy the provided
    buffer into the task's fpu.state.xsave buffer.
    
    Any error while copying or invalid state detected after copying results in
    wiping the target task's FPU state completely including supervisor states.
    
    That's just wrong. The caller supplied invalid data or has a problem with
    unmapped memory, so there is absolutely no justification to corrupt the
    target state.
    
    Fix this with the following modifications:
    
     1) If data has to be copied from userspace, allocate a buffer and copy from
        user first.
    
     2) Use copy_kernel_to_xstate() unconditionally so that header checking
        works correctly.
    
     3) Return on error without corrupting the target state.
    
    This prevents corrupting states and lets the caller deal with the problem
    it caused in the first place.
    Signed-off-by: default avatarThomas Gleixner <tglx@linutronix.de>
    Signed-off-by: default avatarBorislav Petkov <bp@suse.de>
    Reviewed-by: default avatarBorislav Petkov <bp@suse.de>
    Link: https://lkml.kernel.org/r/20210623121452.214903673@linutronix.de
    43be46e8
regset.c 8.16 KB