• Sebastian Andrzej Siewior's avatar
    x86/fpu: Fault-in user stack if copy_fpstate_to_sigframe() fails · d9c9ce34
    Sebastian Andrzej Siewior authored
    In the compacted form, XSAVES may save only the XMM+SSE state but skip
    FP (x87 state).
    
    This is denoted by header->xfeatures = 6. The fastpath
    (copy_fpregs_to_sigframe()) does that but _also_ initialises the FP
    state (cwd to 0x37f, mxcsr as we do, remaining fields to 0).
    
    The slowpath (copy_xstate_to_user()) leaves most of the FP
    state untouched. Only mxcsr and mxcsr_flags are set due to
    xfeatures_mxcsr_quirk(). Now that XFEATURE_MASK_FP is set
    unconditionally, see
    
      04944b79 ("x86: xsave: set FP, SSE bits in the xsave header in the user sigcontext"),
    
    on return from the signal, random garbage is loaded as the FP state.
    
    Instead of utilizing copy_xstate_to_user(), fault-in the user memory
    and retry the fast path. Ideally, the fast path succeeds on the second
    attempt but may be retried again if the memory is swapped out due
    to memory pressure. If the user memory can not be faulted-in then
    get_user_pages() returns an error so we don't loop forever.
    
    Fault in memory via get_user_pages_unlocked() so
    copy_fpregs_to_sigframe() succeeds without a fault.
    
    Fixes: 69277c98 ("x86/fpu: Always store the registers in copy_fpstate_to_sigframe()")
    Reported-by: default avatarKurt Kanzenbach <kurt.kanzenbach@linutronix.de>
    Suggested-by: default avatarDave Hansen <dave.hansen@intel.com>
    Signed-off-by: default avatarSebastian Andrzej Siewior <bigeasy@linutronix.de>
    Signed-off-by: default avatarBorislav Petkov <bp@suse.de>
    Cc: Andy Lutomirski <luto@amacapital.net>
    Cc: Dave Hansen <dave.hansen@intel.com>
    Cc: "H. Peter Anvin" <hpa@zytor.com>
    Cc: Ingo Molnar <mingo@kernel.org>
    Cc: Jann Horn <jannh@google.com>
    Cc: "linux-mm@kvack.org" <linux-mm@kvack.org>
    Cc: Qian Cai <cai@lca.pw>
    Cc: Rik van Riel <riel@surriel.com>
    Cc: Thomas Gleixner <tglx@linutronix.de>
    Cc: x86-ml <x86@kernel.org>
    Link: https://lkml.kernel.org/r/20190502171139.mqtegctsg35cir2e@linutronix.de
    d9c9ce34
signal.c 12.8 KB