x86/fpu: Load xsave pointer *after* initialization
authorBorislav Petkov <bp@suse.de>
Thu, 16 Apr 2015 18:41:37 +0000 (20:41 +0200)
committerIngo Molnar <mingo@kernel.org>
Fri, 17 Apr 2015 08:15:47 +0000 (10:15 +0200)
commit18ecb3bfa5a9f6fffbb3eeb4369f0b9463438ec0
treedd21e99bdb7e2941989207acc03a7c2d1a754134
parentfd0f86b66425bd8c6af8985881e82b28c30fd450
x86/fpu: Load xsave pointer *after* initialization

So I was playing with gdb today and did this simple thing:

gdb /bin/ls

...

(gdb) run

Box exploded with this splat:

BUG: unable to handle kernel NULL pointer dereference at 00000000000001d0
IP: [<ffffffff8100fe5a>] xstateregs_get+0x7a/0x120
[...]

Call Trace:
 ptrace_regset
 ptrace_request
 ? wait_task_inactive
 ? preempt_count_sub
 arch_ptrace
 ? ptrace_get_task_struct
 SyS_ptrace
 system_call_fastpath

... because we do cache &target->thread.fpu.state->xsave into the
local variable xsave but that pointer is NULL at that time and
it gets initialized later, in init_fpu(), see:

e7f180dcd8ab ("x86/fpu: Change xstateregs_get()/set() to use ->xsave.i387 rather than ->fxsave")

The fix is simple: load xsave *after* init_fpu() has run.

Also do the same in xstateregs_set(), as suggested by Oleg Nesterov.

Signed-off-by: Borislav Petkov <bp@suse.de>
Acked-by: Oleg Nesterov <oleg@redhat.com>
Cc: Andy Lutomirski <luto@amacapital.net>
Cc: H. Peter Anvin <hpa@zytor.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Rik van Riel <riel@redhat.com>
Cc: Tavis Ormandy <taviso@google.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Link: http://lkml.kernel.org/r/1429209697-5902-1-git-send-email-bp@alien8.de
Signed-off-by: Ingo Molnar <mingo@kernel.org>
arch/x86/kernel/i387.c