On Mon, Feb 21, 2022 at 10:07:47AM +0100, Borislav Petkov wrote:
> On Mon, Feb 21, 2022 at 07:57:39AM +0100, gregkh@xxxxxxxxxxxxxxxxxxx wrote:
> >
> > The patch below does not apply to the 5.15-stable tree.
> > If someone wants it applied there, or to any other stable or longterm
> > tree, then please email the backport, including the original git commit
> > id to <stable@xxxxxxxxxxxxxxx>.
>
> ---
> >From b0535322d006c7f49e7fca3485991c5f88a5e7cb Mon Sep 17 00:00:00 2001
> From: Andy Lutomirski <luto@xxxxxxxxxx>
> Date: Mon, 14 Feb 2022 13:05:49 +0100
> Subject: [PATCH] x86/ptrace: Fix xfpregs_set()'s incorrect xmm clearing
> MIME-Version: 1.0
> Content-Type: text/plain; charset=UTF-8
> Content-Transfer-Encoding: 8bit
>
> Commit 44cad52cc14ae10062f142ec16ede489bccf4469 upstream.
>
> xfpregs_set() handles 32-bit REGSET_XFP and 64-bit REGSET_FP. The actual
> code treats these regsets as modern FX state (i.e. the beginning part of
> XSTATE). The declarations of the regsets thought they were the legacy
> i387 format. The code thought they were the 32-bit (no xmm8..15) variant
> of XSTATE and, for good measure, made the high bits disappear by zeroing
> the wrong part of the buffer. The latter broke ptrace, and everything
> else confused anyone trying to understand the code. In particular, the
> nonsense definitions of the regsets confused me when I wrote this code.
>
> Clean this all up. Change the declarations to match reality (which
> shouldn't change the generated code, let alone the ABI) and fix
> xfpregs_set() to clear the correct bits and to only do so for 32-bit
> callers.
>
> Fixes: 6164331d15f7 ("x86/fpu: Rewrite xfpregs_set()")
> Reported-by: Luís Ferreira <contact@xxxxxxxxxxxxxx>
> Signed-off-by: Andy Lutomirski <luto@xxxxxxxxxx>
> Signed-off-by: Borislav Petkov <bp@xxxxxxx>
> Cc: <stable@xxxxxxxxxxxxxxx>
> Link: https://bugzilla.kernel.org/show_bug.cgi?id=215524
> Link: https://lore.kernel.org/r/YgpFnZpF01WwR8wU@xxxxxxx
> ---
> arch/x86/kernel/fpu/regset.c | 9 ++++-----
> arch/x86/kernel/ptrace.c | 4 ++--
> 2 files changed, 6 insertions(+), 7 deletions(-)
Now queued up,t hanks.
greg k-h
