@@ -983,6 +983,7 @@ int copy_xstate_to_kernel(void *kbuf, struct xregs_state *xsave, unsigned int of
{
unsigned int offset, size;
struct xstate_header header;
+ int last_off;
int i;
/*
@@ -1006,7 +1007,17 @@ int copy_xstate_to_kernel(void *kbuf, struct xregs_state *xsave, unsigned int of
__copy_xstate_to_kernel(kbuf, &header, offset, size, size_total);
+ last_off = 0;
+
for (i = 0; i < XFEATURE_MAX; i++) {
+ /*
+ * Clear uninitialized area before XSAVE header.
+ */
+ if (i == FIRST_EXTENDED_XFEATURE) {
+ memset(kbuf + last_off, 0, XSAVE_HDR_OFFSET - last_off);
+ last_off = XSAVE_HDR_OFFSET + XSAVE_HDR_SIZE;
+ }
+
/*
* Copy only in-use xstates:
*/
@@ -1020,11 +1031,16 @@ int copy_xstate_to_kernel(void *kbuf, struct xregs_state *xsave, unsigned int of
if (offset + size > size_total)
break;
+ memset(kbuf + last_off, 0, offset - last_off);
+ last_off = offset + size;
+
__copy_xstate_to_kernel(kbuf, src, offset, size, size_total);
}
}
+ memset(kbuf + last_off, 0, size_total - last_off);
+
if (xfeatures_mxcsr_quirk(header.xfeatures)) {
offset = offsetof(struct fxregs_state, mxcsr);
size = MXCSR_AND_FLAGS_SIZE;
In a core dump, copy_xstate_to_kernel() copies only enabled user xfeatures to a kernel buffer without touching areas for disabled xfeatures. However, those uninitialized areas may contain random data, which is then written to the core dump file and can be read by a non-privileged user. Fix it by clearing uninitialized areas. Link: https://github.com/google/kmsan/issues/76 Link: https://lore.kernel.org/lkml/20200419100848.63472-1-glider@google.com/ Signed-off-by: Yu-cheng Yu <yu-cheng.yu@intel.com> Reported-by: sam <sunhaoyl@outlook.com> Cc: "H. Peter Anvin" <hpa@zytor.com> Cc: Kees Cook <keescook@chromium.org> Cc: Alexey Dobriyan <adobriyan@gmail.com> Cc: Thomas Gleixner <tglx@linutronix.de> Cc: Dave Hansen <dave.hansen@intel.com> Cc: Jann Horn <jannh@google.com> Cc: Ingo Molnar <mingo@redhat.com> Cc: Andrew Morton <akpm@linux-foundation.org> Cc: Borislav Petkov <bp@alien8.de> Cc: Alexander Potapenko <glider@google.com> Cc: Al Viro <viro@zeniv.linux.org.uk> Cc: <stable@vger.kernel.org> --- arch/x86/kernel/fpu/xstate.c | 16 ++++++++++++++++ 1 file changed, 16 insertions(+)