• Sebastian Andrzej Siewior's avatar
    x86/fpu: Deactivate FPU state after failure during state load · bbc55341
    Sebastian Andrzej Siewior authored
    In __fpu__restore_sig(), fpu_fpregs_owner_ctx needs to be reset if the
    FPU state was not fully restored. Otherwise the following may happen (on
    the same CPU):
    
      Task A                     Task B               fpu_fpregs_owner_ctx
      *active*                                        A.fpu
      __fpu__restore_sig()
                                 ctx switch           load B.fpu
                                 *active*             B.fpu
      fpregs_lock()
      copy_user_to_fpregs_zeroing()
        copy_kernel_to_xregs() *modify*
        copy_user_to_xregs() *fails*
      fpregs_unlock()
                                ctx switch            skip loading B.fpu,
                                *active*              B.fpu
    
    In the success case, fpu_fpregs_owner_ctx is set to the current task.
    
    In the failure case, the FPU state might have been modified by loading
    the init state.
    
    In this case, fpu_fpregs_owner_ctx needs to be reset in order to ensure
    that the FPU state of the following task is loaded from saved state (and
    not skipped because it was the previous state).
    
    Reset fpu_fpregs_owner_ctx after a failure during restore occurred, to
    ensure that the FPU state for the next task is always loaded.
    
    The problem was debugged-by Yu-cheng Yu <yu-cheng.yu@intel.com>.
    
     [ bp: Massage commit message. ]
    
    Fixes: 5f409e20 ("x86/fpu: Defer FPU state load until return to userspace")
    Reported-by: default avatarYu-cheng Yu <yu-cheng.yu@intel.com>
    Signed-off-by: default avatarSebastian Andrzej Siewior <bigeasy@linutronix.de>
    Signed-off-by: default avatarBorislav Petkov <bp@suse.de>
    Cc: Andy Lutomirski <luto@kernel.org>
    Cc: Dave Hansen <dave.hansen@linux.intel.com>
    Cc: Fenghua Yu <fenghua.yu@intel.com>
    Cc: "H. Peter Anvin" <hpa@zytor.com>
    Cc: Ingo Molnar <mingo@redhat.com>
    Cc: Jann Horn <jannh@google.com>
    Cc: Peter Zijlstra <peterz@infradead.org>
    Cc: "Ravi V. Shankar" <ravi.v.shankar@intel.com>
    Cc: Rik van Riel <riel@surriel.com>
    Cc: Thomas Gleixner <tglx@linutronix.de>
    Cc: Tony Luck <tony.luck@intel.com>
    Cc: x86-ml <x86@kernel.org>
    Link: https://lkml.kernel.org/r/20191220195906.plk6kpmsrikvbcfn@linutronix.de
    bbc55341
signal.c 12.8 KB