diff options
author | Eric Biggers <ebiggers@google.com> | 2017-09-24 06:59:09 -0400 |
---|---|---|
committer | Ingo Molnar <mingo@kernel.org> | 2017-09-26 03:43:47 -0400 |
commit | af95774b3ca080b0e1e651c0fc7680f3444ddda7 (patch) | |
tree | a8a9cb7a3f2da05c49c08a7335c1f051076d879b | |
parent | b89eda482d7849a1c146b6d0a42f4e76369bb08e (diff) |
x86/fpu: Use validate_xstate_header() to validate the xstate_header in copy_kernel_to_xstate()
Tighten the checks in copy_kernel_to_xstate().
Signed-off-by: Eric Biggers <ebiggers@google.com>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Andy Lutomirski <luto@amacapital.net>
Cc: Andy Lutomirski <luto@kernel.org>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Dave Hansen <dave.hansen@linux.intel.com>
Cc: Dmitry Vyukov <dvyukov@google.com>
Cc: Eric Biggers <ebiggers3@gmail.com>
Cc: Fenghua Yu <fenghua.yu@intel.com>
Cc: Kees Cook <keescook@chromium.org>
Cc: Kevin Hao <haokexin@gmail.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Michael Halcrow <mhalcrow@google.com>
Cc: Oleg Nesterov <oleg@redhat.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Rik van Riel <riel@redhat.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Wanpeng Li <wanpeng.li@hotmail.com>
Cc: Yu-cheng Yu <yu-cheng.yu@intel.com>
Cc: kernel-hardening@lists.openwall.com
Link: http://lkml.kernel.org/r/20170924105913.9157-7-mingo@kernel.org
Signed-off-by: Ingo Molnar <mingo@kernel.org>
-rw-r--r-- | arch/x86/kernel/fpu/xstate.c | 12 |
1 files changed, 2 insertions, 10 deletions
diff --git a/arch/x86/kernel/fpu/xstate.c b/arch/x86/kernel/fpu/xstate.c index c97c4a9db52a..325db7850335 100644 --- a/arch/x86/kernel/fpu/xstate.c +++ b/arch/x86/kernel/fpu/xstate.c | |||
@@ -1138,15 +1138,12 @@ int copy_xstate_to_user(void __user *ubuf, struct xregs_state *xsave, unsigned i | |||
1138 | 1138 | ||
1139 | /* | 1139 | /* |
1140 | * Convert from a ptrace standard-format kernel buffer to kernel XSAVES format | 1140 | * Convert from a ptrace standard-format kernel buffer to kernel XSAVES format |
1141 | * and copy to the target thread. This is called from xstateregs_set() and | 1141 | * and copy to the target thread. This is called from xstateregs_set(). |
1142 | * there we check the CPU has XSAVES and a whole standard-sized buffer | ||
1143 | * exists. | ||
1144 | */ | 1142 | */ |
1145 | int copy_kernel_to_xstate(struct xregs_state *xsave, const void *kbuf) | 1143 | int copy_kernel_to_xstate(struct xregs_state *xsave, const void *kbuf) |
1146 | { | 1144 | { |
1147 | unsigned int offset, size; | 1145 | unsigned int offset, size; |
1148 | int i; | 1146 | int i; |
1149 | u64 allowed_features; | ||
1150 | struct xstate_header hdr; | 1147 | struct xstate_header hdr; |
1151 | 1148 | ||
1152 | offset = offsetof(struct xregs_state, header); | 1149 | offset = offsetof(struct xregs_state, header); |
@@ -1154,12 +1151,7 @@ int copy_kernel_to_xstate(struct xregs_state *xsave, const void *kbuf) | |||
1154 | 1151 | ||
1155 | memcpy(&hdr, kbuf + offset, size); | 1152 | memcpy(&hdr, kbuf + offset, size); |
1156 | 1153 | ||
1157 | /* | 1154 | if (validate_xstate_header(&hdr)) |
1158 | * Reject if the user sets any disabled or supervisor features: | ||
1159 | */ | ||
1160 | allowed_features = xfeatures_mask & ~XFEATURE_MASK_SUPERVISOR; | ||
1161 | |||
1162 | if (hdr.xfeatures & ~allowed_features) | ||
1163 | return -EINVAL; | 1155 | return -EINVAL; |
1164 | 1156 | ||
1165 | for (i = 0; i < XFEATURE_MAX; i++) { | 1157 | for (i = 0; i < XFEATURE_MAX; i++) { |