From 51d4027fe65433cc4207a340c0e5a4f1b6e19e4f Mon Sep 17 00:00:00 2001 From: Thomas Gleixner Date: Wed, 13 Oct 2021 16:55:43 +0200 Subject: [PATCH] x86/fpu: Do not leak fpstate pointer on fork mainline inclusion from mainline-v5.16-rc1 commit f0cbc8b3cdf7d1c724155cd9cecffe329bb96119 category: feature bugzilla: https://gitee.com/openeuler/intel-kernel/issues/I590ZC CVE: NA Intel-SIG: commit f0cbc8b3cdf7 x86/fpu: Do not leak fpstate pointer on fork. -------------------------------- If fork fails early then the copied task struct would carry the fpstate pointer of the parent task. Not a problem right now, but later when dynamically allocated buffers are available, keeping the pointer might result in freeing the parent's buffer. Set it to NULL which prevents that. If fork reaches clone_thread(), the pointer will be correctly set to the new task context. Signed-off-by: Thomas Gleixner Signed-off-by: Borislav Petkov Link: https://lkml.kernel.org/r/20211013145322.817101108@linutronix.de Signed-off-by: Lin Wang --- arch/x86/kernel/process.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/arch/x86/kernel/process.c b/arch/x86/kernel/process.c index d708c97fd6fe..f3b2539786a3 100755 --- a/arch/x86/kernel/process.c +++ b/arch/x86/kernel/process.c @@ -93,6 +93,8 @@ int arch_dup_task_struct(struct task_struct *dst, struct task_struct *src) #ifdef CONFIG_VM86 dst->thread.vm86 = NULL; #endif + /* Drop the copied pointer to current's fpstate */ + dst->thread.fpu.fpstate = NULL; return 0; } -- GitLab