Re: [patch 4/8] x86/fpu: Limit xstate copy size in xstateregs_set()

On Wed, Jun 02, 2021 at 11:55:47AM +0200, Thomas Gleixner wrote:

If the count argument is larger than the xstate size, this will happily copy beyond the end of xstate.

Fixes: 91c3dba7dbc1 ("x86/fpu/xstate: Fix PTRACE frames for XSAVES") Signed-off-by: Thomas Gleixner tglx@linutronix.de Cc: stable@vger.kernel.org

---

arch/x86/kernel/fpu/regset.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/arch/x86/kernel/fpu/regset.c +++ b/arch/x86/kernel/fpu/regset.c @@ -117,7 +117,7 @@ int xstateregs_set(struct task_struct *t /* * A whole standard-format XSAVE buffer is needed: */

• if ((pos != 0) || (count < fpu_user_xstate_size))

• if (pos != 0 || count != fpu_user_xstate_size) return -EFAULT;

xsave = &fpu->state.xsave;

Looking at this one, I guess it and all the CC:stable ones should be at the beginning of the set so that they go to Linus now...