In a core dump, copy_xstate_to_kernel() copies only enabled user xfeatures to a kernel buffer without touching areas for disabled xfeatures. However, those uninitialized areas may contain random data, which is then written to the core dump file and can be read by a non-privileged user.
Fix it by clearing uninitialized areas. Link: https://github.com/google/kmsan/issues/76 Link: https://lore.kernel.org/lkml/[email protected]/ Signed-off-by: Yu-cheng Yu <[email protected]> Reported-by: sam <[email protected]> Cc: "H. Peter Anvin" <[email protected]> Cc: Kees Cook <[email protected]> Cc: Alexey Dobriyan <[email protected]> Cc: Thomas Gleixner <[email protected]> Cc: Dave Hansen <[email protected]> Cc: Jann Horn <[email protected]> Cc: Ingo Molnar <[email protected]> Cc: Andrew Morton <[email protected]> Cc: Borislav Petkov <[email protected]> Cc: Alexander Potapenko <[email protected]> Cc: Al Viro <[email protected]> Cc: <[email protected]> --- arch/x86/kernel/fpu/xstate.c | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/arch/x86/kernel/fpu/xstate.c b/arch/x86/kernel/fpu/xstate.c index 32b153d38748..0856daa29be7 100644 --- a/arch/x86/kernel/fpu/xstate.c +++ b/arch/x86/kernel/fpu/xstate.c @@ -983,6 +983,7 @@ int copy_xstate_to_kernel(void *kbuf, struct xregs_state *xsave, unsigned int of { unsigned int offset, size; struct xstate_header header; + int last_off; int i; /* @@ -1006,7 +1007,17 @@ int copy_xstate_to_kernel(void *kbuf, struct xregs_state *xsave, unsigned int of __copy_xstate_to_kernel(kbuf, &header, offset, size, size_total); + last_off = 0; + for (i = 0; i < XFEATURE_MAX; i++) { + /* + * Clear uninitialized area before XSAVE header. + */ + if (i == FIRST_EXTENDED_XFEATURE) { + memset(kbuf + last_off, 0, XSAVE_HDR_OFFSET - last_off); + last_off = XSAVE_HDR_OFFSET + XSAVE_HDR_SIZE; + } + /* * Copy only in-use xstates: */ @@ -1020,11 +1031,16 @@ int copy_xstate_to_kernel(void *kbuf, struct xregs_state *xsave, unsigned int of if (offset + size > size_total) break; + memset(kbuf + last_off, 0, offset - last_off); + last_off = offset + size; + __copy_xstate_to_kernel(kbuf, src, offset, size, size_total); } } + memset(kbuf + last_off, 0, size_total - last_off); + if (xfeatures_mxcsr_quirk(header.xfeatures)) { offset = offsetof(struct fxregs_state, mxcsr); size = MXCSR_AND_FLAGS_SIZE; -- 2.21.0
