x86/fpu/xstate: Fix PKRU covert channel

When XCR0[9] is set, PKRU can be read and written from userspace with
XSAVE and XRSTOR, even when CR4.PKE is clear.

Clear XCR0[9] when protection keys are disabled.

Reported-by: Tavis Ormandy <[email protected]>
Signed-off-by: Jim Mattson <[email protected]>
Signed-off-by: Ingo Molnar <[email protected]>
Acked-by: Dave Hansen <[email protected]>
Link: https://lore.kernel.org/r/[email protected]

diff --git a/arch/x86/kernel/fpu/xstate.c b/arch/x86/kernel/fpu/xstate.c
index 1afbc4866b10094ca73aa95d09a092b2276be1ee..a27b4f7b93651d84dae76c4ef9478381d0460c0c 100644 (file)
--- a/arch/x86/kernel/fpu/xstate.c
+++ b/arch/x86/kernel/fpu/xstate.c
@@ -71,7 +71,7 @@ static unsigned short xsave_cpuid_features[] __initdata = {
        [XFEATURE_ZMM_Hi256]                    = X86_FEATURE_AVX512F,
        [XFEATURE_Hi16_ZMM]                     = X86_FEATURE_AVX512F,
        [XFEATURE_PT_UNIMPLEMENTED_SO_FAR]      = X86_FEATURE_INTEL_PT,
        [XFEATURE_ZMM_Hi256]                    = X86_FEATURE_AVX512F,
        [XFEATURE_Hi16_ZMM]                     = X86_FEATURE_AVX512F,
        [XFEATURE_PT_UNIMPLEMENTED_SO_FAR]      = X86_FEATURE_INTEL_PT,

-       [XFEATURE_PKRU]                         = X86_FEATURE_PKU,
+       [XFEATURE_PKRU]                         = X86_FEATURE_OSPKE,

        [XFEATURE_PASID]                        = X86_FEATURE_ENQCMD,
        [XFEATURE_XTILE_CFG]                    = X86_FEATURE_AMX_TILE,
        [XFEATURE_XTILE_DATA]                   = X86_FEATURE_AMX_TILE,
        [XFEATURE_PASID]                        = X86_FEATURE_ENQCMD,
        [XFEATURE_XTILE_CFG]                    = X86_FEATURE_AMX_TILE,
        [XFEATURE_XTILE_DATA]                   = X86_FEATURE_AMX_TILE,