In a core dump, copy_xstate_to_kernel() copies only enabled user xfeatures to a kernel buffer without touching areas for disabled xfeatures. However, those uninitialized areas may contain random data, which is then written to the core dump file and can be read by a non-privileged user. Fix it by clearing uninitialized areas. Link: https://github.com/google/kmsan/issues/76 Link: https://lore.kernel.org/lkml/20200419100848.63472-1-glider@xxxxxxxxxx/ Signed-off-by: Yu-cheng Yu <yu-cheng.yu@xxxxxxxxx> Reported-by: sam <sunhaoyl@xxxxxxxxxxx> Cc: "H. Peter Anvin" <hpa@xxxxxxxxx> Cc: Kees Cook <keescook@xxxxxxxxxxxx> Cc: Alexey Dobriyan <adobriyan@xxxxxxxxx> Cc: Thomas Gleixner <tglx@xxxxxxxxxxxxx> Cc: Dave Hansen <dave.hansen@xxxxxxxxx> Cc: Jann Horn <jannh@xxxxxxxxxx> Cc: Ingo Molnar <mingo@xxxxxxxxxx> Cc: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx> Cc: Borislav Petkov <bp@xxxxxxxxx> Cc: Alexander Potapenko <glider@xxxxxxxxxx> Cc: Al Viro <viro@xxxxxxxxxxxxxxxxxx> Cc: <stable@xxxxxxxxxxxxxxx> --- arch/x86/kernel/fpu/xstate.c | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/arch/x86/kernel/fpu/xstate.c b/arch/x86/kernel/fpu/xstate.c index 32b153d38748..0856daa29be7 100644 --- a/arch/x86/kernel/fpu/xstate.c +++ b/arch/x86/kernel/fpu/xstate.c @@ -983,6 +983,7 @@ int copy_xstate_to_kernel(void *kbuf, struct xregs_state *xsave, unsigned int of { unsigned int offset, size; struct xstate_header header; + int last_off; int i; /* @@ -1006,7 +1007,17 @@ int copy_xstate_to_kernel(void *kbuf, struct xregs_state *xsave, unsigned int of __copy_xstate_to_kernel(kbuf, &header, offset, size, size_total); + last_off = 0; + for (i = 0; i < XFEATURE_MAX; i++) { + /* + * Clear uninitialized area before XSAVE header. + */ + if (i == FIRST_EXTENDED_XFEATURE) { + memset(kbuf + last_off, 0, XSAVE_HDR_OFFSET - last_off); + last_off = XSAVE_HDR_OFFSET + XSAVE_HDR_SIZE; + } + /* * Copy only in-use xstates: */ @@ -1020,11 +1031,16 @@ int copy_xstate_to_kernel(void *kbuf, struct xregs_state *xsave, unsigned int of if (offset + size > size_total) break; + memset(kbuf + last_off, 0, offset - last_off); + last_off = offset + size; + __copy_xstate_to_kernel(kbuf, src, offset, size, size_total); } } + memset(kbuf + last_off, 0, size_total - last_off); + if (xfeatures_mxcsr_quirk(header.xfeatures)) { offset = offsetof(struct fxregs_state, mxcsr); size = MXCSR_AND_FLAGS_SIZE; -- 2.21.0
