x86/fpu: Preserve supervisor states in sanitize_restored_user_xstate()

sanitize_restored_user_xstate() preserves the supervisor states only
when the fx_only argument is zero, which allows unprivileged user space
to put supervisor states back into init state.

Preserve them unconditionally.

 [ bp: Fix a typo or two in the text. ]

Fixes: 5d6b6a6f9b5c ("x86/fpu/xstate: Update sanitize_restored_xstate() for supervisor xstates")
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Borislav Petkov <bp@suse.de>
Cc: stable@vger.kernel.org
Link: https://lkml.kernel.org/r/20210618143444.438635017@linutronix.de

diff --git a/arch/x86/kernel/fpu/signal.c b/arch/x86/kernel/fpu/signal.c
index ec3ae30..b7b92cd 100644 (file)
--- a/arch/x86/kernel/fpu/signal.c
+++ b/arch/x86/kernel/fpu/signal.c
@@ -221,28 +221,18 @@ sanitize_restored_user_xstate(union fpregs_state *state,
 
        if (use_xsave()) {
                /*
-                * Note: we don't need to zero the reserved bits in the
-                * xstate_header here because we either didn't copy them at all,
-                * or we checked earlier that they aren't set.
+                * Clear all feature bits which are not set in
+                * user_xfeatures and clear all extended features
+                * for fx_only mode.
                 */
+               u64 mask = fx_only ? XFEATURE_MASK_FPSSE : user_xfeatures;
 
                /*
-                * 'user_xfeatures' might have bits clear which are
-                * set in header->xfeatures. This represents features that
-                * were in init state prior to a signal delivery, and need
-                * to be reset back to the init state.  Clear any user
-                * feature bits which are set in the kernel buffer to get
-                * them back to the init state.
-                *
-                * Supervisor state is unchanged by input from userspace.
-                * Ensure supervisor state bits stay set and supervisor
-                * state is not modified.
+                * Supervisor state has to be preserved. The sigframe
+                * restore can only modify user features, i.e. @mask
+                * cannot contain them.
                 */
-               if (fx_only)
-                       header->xfeatures = XFEATURE_MASK_FPSSE;
-               else
-                       header->xfeatures &= user_xfeatures |
-                                            xfeatures_mask_supervisor();
+               header->xfeatures &= mask | xfeatures_mask_supervisor();
        }
 
        if (use_fxsr()) {