From owner-svn-src-releng@freebsd.org Wed Sep 12 05:07:39 2018 Return-Path: Delivered-To: svn-src-releng@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 1701410A932D; Wed, 12 Sep 2018 05:07:39 +0000 (UTC) (envelope-from gordon@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client CN "mxrelay.nyi.freebsd.org", Issuer "Let's Encrypt Authority X3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id B7ADA71516; Wed, 12 Sep 2018 05:07:38 +0000 (UTC) (envelope-from gordon@FreeBSD.org) Received: from repo.freebsd.org (repo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id A9E4F21FF8; Wed, 12 Sep 2018 05:07:38 +0000 (UTC) (envelope-from gordon@FreeBSD.org) Received: from repo.freebsd.org ([127.0.1.37]) by repo.freebsd.org (8.15.2/8.15.2) with ESMTP id w8C57cVB020803; Wed, 12 Sep 2018 05:07:38 GMT (envelope-from gordon@FreeBSD.org) Received: (from gordon@localhost) by repo.freebsd.org (8.15.2/8.15.2/Submit) id w8C57ZlT020790; Wed, 12 Sep 2018 05:07:35 GMT (envelope-from gordon@FreeBSD.org) Message-Id: <201809120507.w8C57ZlT020790@repo.freebsd.org> X-Authentication-Warning: repo.freebsd.org: gordon set sender to gordon@FreeBSD.org using -f From: Gordon Tetlow Date: Wed, 12 Sep 2018 05:07:35 +0000 (UTC) To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-releng@freebsd.org Subject: svn commit: r338606 - in releng: 10.4 10.4/sys/conf 10.4/sys/kern 11.1 11.1/sys/conf 11.1/sys/kern 11.2 11.2/sys/conf 11.2/sys/kern X-SVN-Group: releng X-SVN-Commit-Author: gordon X-SVN-Commit-Paths: in releng: 10.4 10.4/sys/conf 10.4/sys/kern 11.1 11.1/sys/conf 11.1/sys/kern 11.2 11.2/sys/conf 11.2/sys/kern X-SVN-Commit-Revision: 338606 X-SVN-Commit-Repository: base MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-src-releng@freebsd.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: SVN commit messages for the release engineering / security commits to the src tree List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 12 Sep 2018 05:07:39 -0000 Author: gordon Date: Wed Sep 12 05:07:35 2018 New Revision: 338606 URL: https://svnweb.freebsd.org/changeset/base/338606 Log: Fix improper elf header parsing. [SA-18:12.elf] Approved by: so Security: FreeBSD-SA-18:12.elf Security: CVE-2018-6924 Modified: releng/10.4/UPDATING releng/10.4/sys/conf/newvers.sh releng/10.4/sys/kern/imgact_elf.c releng/10.4/sys/kern/vfs_vnops.c releng/11.1/UPDATING releng/11.1/sys/conf/newvers.sh releng/11.1/sys/kern/imgact_elf.c releng/11.1/sys/kern/vfs_vnops.c releng/11.2/UPDATING releng/11.2/sys/conf/newvers.sh releng/11.2/sys/kern/imgact_elf.c releng/11.2/sys/kern/vfs_vnops.c Modified: releng/10.4/UPDATING ============================================================================== --- releng/10.4/UPDATING Wed Sep 12 05:03:30 2018 (r338605) +++ releng/10.4/UPDATING Wed Sep 12 05:07:35 2018 (r338606) @@ -17,6 +17,10 @@ stable/10, and then rebuild without this option. The b older version of current is a bit fragile. +20180912 p12 FreeBSD-SA-18:12.elf + + Fix improper elf header parsing. + 20180814 p11 FreeBSD-SA-18:08.tcp [revised] FreeBSD-SA-18:11.hostapd Modified: releng/10.4/sys/conf/newvers.sh ============================================================================== --- releng/10.4/sys/conf/newvers.sh Wed Sep 12 05:03:30 2018 (r338605) +++ releng/10.4/sys/conf/newvers.sh Wed Sep 12 05:07:35 2018 (r338606) @@ -32,7 +32,7 @@ TYPE="FreeBSD" REVISION="10.4" -BRANCH="RELEASE-p11" +BRANCH="RELEASE-p12" if [ "X${BRANCH_OVERRIDE}" != "X" ]; then BRANCH=${BRANCH_OVERRIDE} fi Modified: releng/10.4/sys/kern/imgact_elf.c ============================================================================== --- releng/10.4/sys/kern/imgact_elf.c Wed Sep 12 05:03:30 2018 (r338605) +++ releng/10.4/sys/kern/imgact_elf.c Wed Sep 12 05:07:35 2018 (r338606) @@ -795,7 +795,8 @@ __CONCAT(exec_, __elfN(imgact))(struct image_params *i break; case PT_INTERP: /* Path to interpreter */ - if (phdr[i].p_filesz > MAXPATHLEN) { + if (phdr[i].p_filesz < 2 || + phdr[i].p_filesz > MAXPATHLEN) { uprintf("Invalid PT_INTERP\n"); error = ENOEXEC; goto ret; @@ -825,6 +826,11 @@ __CONCAT(exec_, __elfN(imgact))(struct image_params *i } else { interp = __DECONST(char *, imgp->image_header) + phdr[i].p_offset; + if (interp[interp_name_len - 1] != '\0') { + uprintf("Invalid PT_INTERP\n"); + error = ENOEXEC; + goto ret; + } } break; case PT_GNU_STACK: Modified: releng/10.4/sys/kern/vfs_vnops.c ============================================================================== --- releng/10.4/sys/kern/vfs_vnops.c Wed Sep 12 05:03:30 2018 (r338605) +++ releng/10.4/sys/kern/vfs_vnops.c Wed Sep 12 05:07:35 2018 (r338606) @@ -510,6 +510,8 @@ vn_rdwr(enum uio_rw rw, struct vnode *vp, void *base, struct vn_io_fault_args args; int error, lock_flags; + if (offset < 0 && vp->v_type != VCHR) + return (EINVAL); auio.uio_iov = &aiov; auio.uio_iovcnt = 1; aiov.iov_base = base; Modified: releng/11.1/UPDATING ============================================================================== --- releng/11.1/UPDATING Wed Sep 12 05:03:30 2018 (r338605) +++ releng/11.1/UPDATING Wed Sep 12 05:07:35 2018 (r338606) @@ -16,6 +16,13 @@ from older versions of FreeBSD, try WITHOUT_CLANG and the tip of head, and then rebuild without this option. The bootstrap process from older version of current across the gcc/clang cutover is a bit fragile. +20180912 p14 FreeBSD-SA-18:12.elf + FreeBSD-EN-18:08.lazyfpu + + Fix improper elf header parsing. [SA-18:12.elf] + + Fix regression in Lazy FPU remediation. [EN-18:08.lazyfpu] + 20180814 p13 FreeBSD-SA-18:08.tcp [revised] FreeBSD-SA-18:09.l1tf FreeBSD-SA-18:10.ip Modified: releng/11.1/sys/conf/newvers.sh ============================================================================== --- releng/11.1/sys/conf/newvers.sh Wed Sep 12 05:03:30 2018 (r338605) +++ releng/11.1/sys/conf/newvers.sh Wed Sep 12 05:07:35 2018 (r338606) @@ -44,7 +44,7 @@ TYPE="FreeBSD" REVISION="11.1" -BRANCH="RELEASE-p13" +BRANCH="RELEASE-p14" if [ -n "${BRANCH_OVERRIDE}" ]; then BRANCH=${BRANCH_OVERRIDE} fi Modified: releng/11.1/sys/kern/imgact_elf.c ============================================================================== --- releng/11.1/sys/kern/imgact_elf.c Wed Sep 12 05:03:30 2018 (r338605) +++ releng/11.1/sys/kern/imgact_elf.c Wed Sep 12 05:07:35 2018 (r338606) @@ -834,7 +834,8 @@ __CONCAT(exec_, __elfN(imgact))(struct image_params *i break; case PT_INTERP: /* Path to interpreter */ - if (phdr[i].p_filesz > MAXPATHLEN) { + if (phdr[i].p_filesz < 2 || + phdr[i].p_filesz > MAXPATHLEN) { uprintf("Invalid PT_INTERP\n"); error = ENOEXEC; goto ret; @@ -864,6 +865,11 @@ __CONCAT(exec_, __elfN(imgact))(struct image_params *i } else { interp = __DECONST(char *, imgp->image_header) + phdr[i].p_offset; + if (interp[interp_name_len - 1] != '\0') { + uprintf("Invalid PT_INTERP\n"); + error = ENOEXEC; + goto ret; + } } break; case PT_GNU_STACK: Modified: releng/11.1/sys/kern/vfs_vnops.c ============================================================================== --- releng/11.1/sys/kern/vfs_vnops.c Wed Sep 12 05:03:30 2018 (r338605) +++ releng/11.1/sys/kern/vfs_vnops.c Wed Sep 12 05:07:35 2018 (r338606) @@ -529,6 +529,8 @@ vn_rdwr(enum uio_rw rw, struct vnode *vp, void *base, struct vn_io_fault_args args; int error, lock_flags; + if (offset < 0 && vp->v_type != VCHR) + return (EINVAL); auio.uio_iov = &aiov; auio.uio_iovcnt = 1; aiov.iov_base = base; Modified: releng/11.2/UPDATING ============================================================================== --- releng/11.2/UPDATING Wed Sep 12 05:03:30 2018 (r338605) +++ releng/11.2/UPDATING Wed Sep 12 05:07:35 2018 (r338606) @@ -16,6 +16,13 @@ from older versions of FreeBSD, try WITHOUT_CLANG and the tip of head, and then rebuild without this option. The bootstrap process from older version of current across the gcc/clang cutover is a bit fragile. +20180912 p3 FreeBSD-SA-18:12.elf + FreeBSD-EN-18:08.lazyfpu + + Fix improper elf header parsing. [SA-18:12.elf] + + Fix regression in Lazy FPU remediation. [EN-18:08.lazyfpu] + 20180814 p2 FreeBSD-SA-18:08.tcp [revised] FreeBSD-SA-18:09.l1tf FreeBSD-SA-18:10.ip Modified: releng/11.2/sys/conf/newvers.sh ============================================================================== --- releng/11.2/sys/conf/newvers.sh Wed Sep 12 05:03:30 2018 (r338605) +++ releng/11.2/sys/conf/newvers.sh Wed Sep 12 05:07:35 2018 (r338606) @@ -44,7 +44,7 @@ TYPE="FreeBSD" REVISION="11.2" -BRANCH="RELEASE-p2" +BRANCH="RELEASE-p3" if [ -n "${BRANCH_OVERRIDE}" ]; then BRANCH=${BRANCH_OVERRIDE} fi Modified: releng/11.2/sys/kern/imgact_elf.c ============================================================================== --- releng/11.2/sys/kern/imgact_elf.c Wed Sep 12 05:03:30 2018 (r338605) +++ releng/11.2/sys/kern/imgact_elf.c Wed Sep 12 05:07:35 2018 (r338606) @@ -839,7 +839,8 @@ __CONCAT(exec_, __elfN(imgact))(struct image_params *i break; case PT_INTERP: /* Path to interpreter */ - if (phdr[i].p_filesz > MAXPATHLEN) { + if (phdr[i].p_filesz < 2 || + phdr[i].p_filesz > MAXPATHLEN) { uprintf("Invalid PT_INTERP\n"); error = ENOEXEC; goto ret; @@ -869,6 +870,11 @@ __CONCAT(exec_, __elfN(imgact))(struct image_params *i } else { interp = __DECONST(char *, imgp->image_header) + phdr[i].p_offset; + if (interp[interp_name_len - 1] != '\0') { + uprintf("Invalid PT_INTERP\n"); + error = ENOEXEC; + goto ret; + } } break; case PT_GNU_STACK: Modified: releng/11.2/sys/kern/vfs_vnops.c ============================================================================== --- releng/11.2/sys/kern/vfs_vnops.c Wed Sep 12 05:03:30 2018 (r338605) +++ releng/11.2/sys/kern/vfs_vnops.c Wed Sep 12 05:07:35 2018 (r338606) @@ -528,6 +528,8 @@ vn_rdwr(enum uio_rw rw, struct vnode *vp, void *base, struct vn_io_fault_args args; int error, lock_flags; + if (offset < 0 && vp->v_type != VCHR) + return (EINVAL); auio.uio_iov = &aiov; auio.uio_iovcnt = 1; aiov.iov_base = base; From owner-svn-src-releng@freebsd.org Wed Sep 12 05:08:52 2018 Return-Path: Delivered-To: svn-src-releng@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 1D0E410A93B6; Wed, 12 Sep 2018 05:08:52 +0000 (UTC) (envelope-from gordon@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client CN "mxrelay.nyi.freebsd.org", Issuer "Let's Encrypt Authority X3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id BB3B27165F; Wed, 12 Sep 2018 05:08:51 +0000 (UTC) (envelope-from gordon@FreeBSD.org) Received: from repo.freebsd.org (repo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id B2E8121FFA; Wed, 12 Sep 2018 05:08:51 +0000 (UTC) (envelope-from gordon@FreeBSD.org) Received: from repo.freebsd.org ([127.0.1.37]) by repo.freebsd.org (8.15.2/8.15.2) with ESMTP id w8C58piv020902; Wed, 12 Sep 2018 05:08:51 GMT (envelope-from gordon@FreeBSD.org) Received: (from gordon@localhost) by repo.freebsd.org (8.15.2/8.15.2/Submit) id w8C58nQM020894; Wed, 12 Sep 2018 05:08:49 GMT (envelope-from gordon@FreeBSD.org) Message-Id: <201809120508.w8C58nQM020894@repo.freebsd.org> X-Authentication-Warning: repo.freebsd.org: gordon set sender to gordon@FreeBSD.org using -f From: Gordon Tetlow Date: Wed, 12 Sep 2018 05:08:49 +0000 (UTC) To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-releng@freebsd.org Subject: svn commit: r338607 - in releng: 11.1/sys/amd64/amd64 11.1/sys/i386/i386 11.1/sys/i386/isa 11.2/sys/amd64/amd64 11.2/sys/i386/i386 11.2/sys/i386/isa X-SVN-Group: releng X-SVN-Commit-Author: gordon X-SVN-Commit-Paths: in releng: 11.1/sys/amd64/amd64 11.1/sys/i386/i386 11.1/sys/i386/isa 11.2/sys/amd64/amd64 11.2/sys/i386/i386 11.2/sys/i386/isa X-SVN-Commit-Revision: 338607 X-SVN-Commit-Repository: base MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-src-releng@freebsd.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: SVN commit messages for the release engineering / security commits to the src tree List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 12 Sep 2018 05:08:52 -0000 Author: gordon Date: Wed Sep 12 05:08:49 2018 New Revision: 338607 URL: https://svnweb.freebsd.org/changeset/base/338607 Log: Fix regression in Lazy FPU remediation. [EN-18:08.lazyfpu] Approved by: so Security: FreeBSD-EN-18:08.lazyfpu Modified: releng/11.1/sys/amd64/amd64/fpu.c releng/11.1/sys/amd64/amd64/machdep.c releng/11.1/sys/i386/i386/machdep.c releng/11.1/sys/i386/isa/npx.c releng/11.2/sys/amd64/amd64/fpu.c releng/11.2/sys/amd64/amd64/machdep.c releng/11.2/sys/i386/i386/machdep.c releng/11.2/sys/i386/isa/npx.c Modified: releng/11.1/sys/amd64/amd64/fpu.c ============================================================================== --- releng/11.1/sys/amd64/amd64/fpu.c Wed Sep 12 05:07:35 2018 (r338606) +++ releng/11.1/sys/amd64/amd64/fpu.c Wed Sep 12 05:08:49 2018 (r338607) @@ -743,22 +743,22 @@ fpugetregs(struct thread *td) int max_ext_n, i, owned; pcb = td->td_pcb; + critical_enter(); if ((pcb->pcb_flags & PCB_USERFPUINITDONE) == 0) { bcopy(fpu_initialstate, get_pcb_user_save_pcb(pcb), cpu_max_ext_state_size); get_pcb_user_save_pcb(pcb)->sv_env.en_cw = pcb->pcb_initial_fpucw; fpuuserinited(td); + critical_exit(); return (_MC_FPOWNED_PCB); } - critical_enter(); if (td == PCPU_GET(fpcurthread) && PCB_USER_FPU(pcb)) { fpusave(get_pcb_user_save_pcb(pcb)); owned = _MC_FPOWNED_FPU; } else { owned = _MC_FPOWNED_PCB; } - critical_exit(); if (use_xsave) { /* * Handle partially saved state. @@ -778,6 +778,7 @@ fpugetregs(struct thread *td) *xstate_bv |= bit; } } + critical_exit(); return (owned); } @@ -786,6 +787,7 @@ fpuuserinited(struct thread *td) { struct pcb *pcb; + CRITICAL_ASSERT(td); pcb = td->td_pcb; if (PCB_USER_FPU(pcb)) set_pcb_flags(pcb, @@ -843,26 +845,25 @@ fpusetregs(struct thread *td, struct savefpu *addr, ch int error; pcb = td->td_pcb; + error = 0; critical_enter(); if (td == PCPU_GET(fpcurthread) && PCB_USER_FPU(pcb)) { error = fpusetxstate(td, xfpustate, xfpustate_size); - if (error != 0) { - critical_exit(); - return (error); + if (error == 0) { + bcopy(addr, get_pcb_user_save_td(td), sizeof(*addr)); + fpurestore(get_pcb_user_save_td(td)); + set_pcb_flags(pcb, PCB_FPUINITDONE | + PCB_USERFPUINITDONE); } - bcopy(addr, get_pcb_user_save_td(td), sizeof(*addr)); - fpurestore(get_pcb_user_save_td(td)); - critical_exit(); - set_pcb_flags(pcb, PCB_FPUINITDONE | PCB_USERFPUINITDONE); } else { - critical_exit(); error = fpusetxstate(td, xfpustate, xfpustate_size); - if (error != 0) - return (error); - bcopy(addr, get_pcb_user_save_td(td), sizeof(*addr)); - fpuuserinited(td); + if (error == 0) { + bcopy(addr, get_pcb_user_save_td(td), sizeof(*addr)); + fpuuserinited(td); + } } - return (0); + critical_exit(); + return (error); } /* @@ -1035,6 +1036,7 @@ fpu_kern_enter(struct thread *td, struct fpu_kern_ctx ctx->flags = FPU_KERN_CTX_DUMMY | FPU_KERN_CTX_INUSE; return (0); } + critical_enter(); KASSERT(!PCB_USER_FPU(pcb) || pcb->pcb_save == get_pcb_user_save_pcb(pcb), ("mangled pcb_save")); ctx->flags = FPU_KERN_CTX_INUSE; @@ -1045,6 +1047,7 @@ fpu_kern_enter(struct thread *td, struct fpu_kern_ctx pcb->pcb_save = fpu_kern_ctx_savefpu(ctx); set_pcb_flags(pcb, PCB_KERNFPU); clear_pcb_flags(pcb, PCB_FPUINITDONE); + critical_exit(); return (0); } @@ -1063,7 +1066,6 @@ fpu_kern_leave(struct thread *td, struct fpu_kern_ctx clear_pcb_flags(pcb, PCB_FPUNOSAVE | PCB_FPUINITDONE); start_emulating(); - critical_exit(); } else { KASSERT((ctx->flags & FPU_KERN_CTX_INUSE) != 0, ("leaving not inuse ctx")); @@ -1077,7 +1079,6 @@ fpu_kern_leave(struct thread *td, struct fpu_kern_ctx critical_enter(); if (curthread == PCPU_GET(fpcurthread)) fpudrop(); - critical_exit(); pcb->pcb_save = ctx->prev; } @@ -1094,6 +1095,7 @@ fpu_kern_leave(struct thread *td, struct fpu_kern_ctx clear_pcb_flags(pcb, PCB_FPUINITDONE); KASSERT(!PCB_USER_FPU(pcb), ("unpaired fpu_kern_leave")); } + critical_exit(); return (0); } Modified: releng/11.1/sys/amd64/amd64/machdep.c ============================================================================== --- releng/11.1/sys/amd64/amd64/machdep.c Wed Sep 12 05:07:35 2018 (r338606) +++ releng/11.1/sys/amd64/amd64/machdep.c Wed Sep 12 05:08:49 2018 (r338607) @@ -2148,8 +2148,10 @@ int set_fpregs(struct thread *td, struct fpreg *fpregs) { + critical_enter(); set_fpregs_xmm(fpregs, get_pcb_user_save_td(td)); fpuuserinited(td); + critical_exit(); return (0); } Modified: releng/11.1/sys/i386/i386/machdep.c ============================================================================== --- releng/11.1/sys/i386/i386/machdep.c Wed Sep 12 05:07:35 2018 (r338606) +++ releng/11.1/sys/i386/i386/machdep.c Wed Sep 12 05:08:49 2018 (r338607) @@ -2998,6 +2998,7 @@ int set_fpregs(struct thread *td, struct fpreg *fpregs) { + critical_enter(); if (cpu_fxsr) npx_set_fpregs_xmm((struct save87 *)fpregs, &get_pcb_user_save_td(td)->sv_xmm); @@ -3005,6 +3006,7 @@ set_fpregs(struct thread *td, struct fpreg *fpregs) bcopy(fpregs, &get_pcb_user_save_td(td)->sv_87, sizeof(*fpregs)); npxuserinited(td); + critical_exit(); return (0); } Modified: releng/11.1/sys/i386/isa/npx.c ============================================================================== --- releng/11.1/sys/i386/isa/npx.c Wed Sep 12 05:07:35 2018 (r338606) +++ releng/11.1/sys/i386/isa/npx.c Wed Sep 12 05:08:49 2018 (r338607) @@ -974,14 +974,15 @@ npxgetregs(struct thread *td) return (_MC_FPOWNED_NONE); pcb = td->td_pcb; + critical_enter(); if ((pcb->pcb_flags & PCB_NPXINITDONE) == 0) { bcopy(npx_initialstate, get_pcb_user_save_pcb(pcb), cpu_max_ext_state_size); SET_FPU_CW(get_pcb_user_save_pcb(pcb), pcb->pcb_initial_npxcw); npxuserinited(td); + critical_exit(); return (_MC_FPOWNED_PCB); } - critical_enter(); if (td == PCPU_GET(fpcurthread)) { fpusave(get_pcb_user_save_pcb(pcb)); if (!cpu_fxsr) @@ -995,7 +996,6 @@ npxgetregs(struct thread *td) } else { owned = _MC_FPOWNED_PCB; } - critical_exit(); if (use_xsave) { /* * Handle partially saved state. @@ -1018,6 +1018,7 @@ npxgetregs(struct thread *td) *xstate_bv |= bit; } } + critical_exit(); return (owned); } @@ -1026,6 +1027,7 @@ npxuserinited(struct thread *td) { struct pcb *pcb; + CRITICAL_ASSERT(td); pcb = td->td_pcb; if (PCB_USER_FPU(pcb)) pcb->pcb_flags |= PCB_NPXINITDONE; @@ -1081,28 +1083,26 @@ npxsetregs(struct thread *td, union savefpu *addr, cha return (ENXIO); pcb = td->td_pcb; + error = 0; critical_enter(); if (td == PCPU_GET(fpcurthread) && PCB_USER_FPU(pcb)) { error = npxsetxstate(td, xfpustate, xfpustate_size); - if (error != 0) { - critical_exit(); - return (error); + if (error == 0) { + if (!cpu_fxsr) + fnclex(); /* As in npxdrop(). */ + bcopy(addr, get_pcb_user_save_td(td), sizeof(*addr)); + fpurstor(get_pcb_user_save_td(td)); + pcb->pcb_flags |= PCB_NPXUSERINITDONE | PCB_NPXINITDONE; } - if (!cpu_fxsr) - fnclex(); /* As in npxdrop(). */ - bcopy(addr, get_pcb_user_save_td(td), sizeof(*addr)); - fpurstor(get_pcb_user_save_td(td)); - critical_exit(); - pcb->pcb_flags |= PCB_NPXUSERINITDONE | PCB_NPXINITDONE; } else { - critical_exit(); error = npxsetxstate(td, xfpustate, xfpustate_size); - if (error != 0) - return (error); - bcopy(addr, get_pcb_user_save_td(td), sizeof(*addr)); - npxuserinited(td); + if (error == 0) { + bcopy(addr, get_pcb_user_save_td(td), sizeof(*addr)); + npxuserinited(td); + } } - return (0); + critical_exit(); + return (error); } static void @@ -1371,6 +1371,7 @@ fpu_kern_enter(struct thread *td, struct fpu_kern_ctx return (0); } pcb = td->td_pcb; + critical_enter(); KASSERT(!PCB_USER_FPU(pcb) || pcb->pcb_save == get_pcb_user_save_pcb(pcb), ("mangled pcb_save")); ctx->flags = FPU_KERN_CTX_INUSE; @@ -1381,6 +1382,7 @@ fpu_kern_enter(struct thread *td, struct fpu_kern_ctx pcb->pcb_save = fpu_kern_ctx_savefpu(ctx); pcb->pcb_flags |= PCB_KERNNPX; pcb->pcb_flags &= ~PCB_NPXINITDONE; + critical_exit(); return (0); } @@ -1399,7 +1401,6 @@ fpu_kern_leave(struct thread *td, struct fpu_kern_ctx critical_enter(); if (curthread == PCPU_GET(fpcurthread)) npxdrop(); - critical_exit(); pcb->pcb_save = ctx->prev; if (pcb->pcb_save == get_pcb_user_save_pcb(pcb)) { if ((pcb->pcb_flags & PCB_NPXUSERINITDONE) != 0) @@ -1414,6 +1415,7 @@ fpu_kern_leave(struct thread *td, struct fpu_kern_ctx pcb->pcb_flags &= ~PCB_NPXINITDONE; KASSERT(!PCB_USER_FPU(pcb), ("unpaired fpu_kern_leave")); } + critical_exit(); return (0); } Modified: releng/11.2/sys/amd64/amd64/fpu.c ============================================================================== --- releng/11.2/sys/amd64/amd64/fpu.c Wed Sep 12 05:07:35 2018 (r338606) +++ releng/11.2/sys/amd64/amd64/fpu.c Wed Sep 12 05:08:49 2018 (r338607) @@ -744,22 +744,22 @@ fpugetregs(struct thread *td) int max_ext_n, i, owned; pcb = td->td_pcb; + critical_enter(); if ((pcb->pcb_flags & PCB_USERFPUINITDONE) == 0) { bcopy(fpu_initialstate, get_pcb_user_save_pcb(pcb), cpu_max_ext_state_size); get_pcb_user_save_pcb(pcb)->sv_env.en_cw = pcb->pcb_initial_fpucw; fpuuserinited(td); + critical_exit(); return (_MC_FPOWNED_PCB); } - critical_enter(); if (td == PCPU_GET(fpcurthread) && PCB_USER_FPU(pcb)) { fpusave(get_pcb_user_save_pcb(pcb)); owned = _MC_FPOWNED_FPU; } else { owned = _MC_FPOWNED_PCB; } - critical_exit(); if (use_xsave) { /* * Handle partially saved state. @@ -779,6 +779,7 @@ fpugetregs(struct thread *td) *xstate_bv |= bit; } } + critical_exit(); return (owned); } @@ -787,6 +788,7 @@ fpuuserinited(struct thread *td) { struct pcb *pcb; + CRITICAL_ASSERT(td); pcb = td->td_pcb; if (PCB_USER_FPU(pcb)) set_pcb_flags(pcb, @@ -845,26 +847,25 @@ fpusetregs(struct thread *td, struct savefpu *addr, ch addr->sv_env.en_mxcsr &= cpu_mxcsr_mask; pcb = td->td_pcb; + error = 0; critical_enter(); if (td == PCPU_GET(fpcurthread) && PCB_USER_FPU(pcb)) { error = fpusetxstate(td, xfpustate, xfpustate_size); - if (error != 0) { - critical_exit(); - return (error); + if (error == 0) { + bcopy(addr, get_pcb_user_save_td(td), sizeof(*addr)); + fpurestore(get_pcb_user_save_td(td)); + set_pcb_flags(pcb, PCB_FPUINITDONE | + PCB_USERFPUINITDONE); } - bcopy(addr, get_pcb_user_save_td(td), sizeof(*addr)); - fpurestore(get_pcb_user_save_td(td)); - critical_exit(); - set_pcb_flags(pcb, PCB_FPUINITDONE | PCB_USERFPUINITDONE); } else { - critical_exit(); error = fpusetxstate(td, xfpustate, xfpustate_size); - if (error != 0) - return (error); - bcopy(addr, get_pcb_user_save_td(td), sizeof(*addr)); - fpuuserinited(td); + if (error == 0) { + bcopy(addr, get_pcb_user_save_td(td), sizeof(*addr)); + fpuuserinited(td); + } } - return (0); + critical_exit(); + return (error); } /* @@ -1037,6 +1038,7 @@ fpu_kern_enter(struct thread *td, struct fpu_kern_ctx ctx->flags = FPU_KERN_CTX_DUMMY | FPU_KERN_CTX_INUSE; return (0); } + critical_enter(); KASSERT(!PCB_USER_FPU(pcb) || pcb->pcb_save == get_pcb_user_save_pcb(pcb), ("mangled pcb_save")); ctx->flags = FPU_KERN_CTX_INUSE; @@ -1047,6 +1049,7 @@ fpu_kern_enter(struct thread *td, struct fpu_kern_ctx pcb->pcb_save = fpu_kern_ctx_savefpu(ctx); set_pcb_flags(pcb, PCB_KERNFPU); clear_pcb_flags(pcb, PCB_FPUINITDONE); + critical_exit(); return (0); } @@ -1065,7 +1068,6 @@ fpu_kern_leave(struct thread *td, struct fpu_kern_ctx clear_pcb_flags(pcb, PCB_FPUNOSAVE | PCB_FPUINITDONE); start_emulating(); - critical_exit(); } else { KASSERT((ctx->flags & FPU_KERN_CTX_INUSE) != 0, ("leaving not inuse ctx")); @@ -1079,7 +1081,6 @@ fpu_kern_leave(struct thread *td, struct fpu_kern_ctx critical_enter(); if (curthread == PCPU_GET(fpcurthread)) fpudrop(); - critical_exit(); pcb->pcb_save = ctx->prev; } @@ -1096,6 +1097,7 @@ fpu_kern_leave(struct thread *td, struct fpu_kern_ctx clear_pcb_flags(pcb, PCB_FPUINITDONE); KASSERT(!PCB_USER_FPU(pcb), ("unpaired fpu_kern_leave")); } + critical_exit(); return (0); } Modified: releng/11.2/sys/amd64/amd64/machdep.c ============================================================================== --- releng/11.2/sys/amd64/amd64/machdep.c Wed Sep 12 05:07:35 2018 (r338606) +++ releng/11.2/sys/amd64/amd64/machdep.c Wed Sep 12 05:08:49 2018 (r338607) @@ -2157,8 +2157,10 @@ int set_fpregs(struct thread *td, struct fpreg *fpregs) { + critical_enter(); set_fpregs_xmm(fpregs, get_pcb_user_save_td(td)); fpuuserinited(td); + critical_exit(); return (0); } Modified: releng/11.2/sys/i386/i386/machdep.c ============================================================================== --- releng/11.2/sys/i386/i386/machdep.c Wed Sep 12 05:07:35 2018 (r338606) +++ releng/11.2/sys/i386/i386/machdep.c Wed Sep 12 05:08:49 2018 (r338607) @@ -3004,6 +3004,7 @@ int set_fpregs(struct thread *td, struct fpreg *fpregs) { + critical_enter(); if (cpu_fxsr) npx_set_fpregs_xmm((struct save87 *)fpregs, &get_pcb_user_save_td(td)->sv_xmm); @@ -3011,6 +3012,7 @@ set_fpregs(struct thread *td, struct fpreg *fpregs) bcopy(fpregs, &get_pcb_user_save_td(td)->sv_87, sizeof(*fpregs)); npxuserinited(td); + critical_exit(); return (0); } Modified: releng/11.2/sys/i386/isa/npx.c ============================================================================== --- releng/11.2/sys/i386/isa/npx.c Wed Sep 12 05:07:35 2018 (r338606) +++ releng/11.2/sys/i386/isa/npx.c Wed Sep 12 05:08:49 2018 (r338607) @@ -974,14 +974,15 @@ npxgetregs(struct thread *td) return (_MC_FPOWNED_NONE); pcb = td->td_pcb; + critical_enter(); if ((pcb->pcb_flags & PCB_NPXINITDONE) == 0) { bcopy(npx_initialstate, get_pcb_user_save_pcb(pcb), cpu_max_ext_state_size); SET_FPU_CW(get_pcb_user_save_pcb(pcb), pcb->pcb_initial_npxcw); npxuserinited(td); + critical_exit(); return (_MC_FPOWNED_PCB); } - critical_enter(); if (td == PCPU_GET(fpcurthread)) { fpusave(get_pcb_user_save_pcb(pcb)); if (!cpu_fxsr) @@ -995,7 +996,6 @@ npxgetregs(struct thread *td) } else { owned = _MC_FPOWNED_PCB; } - critical_exit(); if (use_xsave) { /* * Handle partially saved state. @@ -1018,6 +1018,7 @@ npxgetregs(struct thread *td) *xstate_bv |= bit; } } + critical_exit(); return (owned); } @@ -1026,6 +1027,7 @@ npxuserinited(struct thread *td) { struct pcb *pcb; + CRITICAL_ASSERT(td); pcb = td->td_pcb; if (PCB_USER_FPU(pcb)) pcb->pcb_flags |= PCB_NPXINITDONE; @@ -1083,28 +1085,26 @@ npxsetregs(struct thread *td, union savefpu *addr, cha if (cpu_fxsr) addr->sv_xmm.sv_env.en_mxcsr &= cpu_mxcsr_mask; pcb = td->td_pcb; + error = 0; critical_enter(); if (td == PCPU_GET(fpcurthread) && PCB_USER_FPU(pcb)) { error = npxsetxstate(td, xfpustate, xfpustate_size); - if (error != 0) { - critical_exit(); - return (error); + if (error == 0) { + if (!cpu_fxsr) + fnclex(); /* As in npxdrop(). */ + bcopy(addr, get_pcb_user_save_td(td), sizeof(*addr)); + fpurstor(get_pcb_user_save_td(td)); + pcb->pcb_flags |= PCB_NPXUSERINITDONE | PCB_NPXINITDONE; } - if (!cpu_fxsr) - fnclex(); /* As in npxdrop(). */ - bcopy(addr, get_pcb_user_save_td(td), sizeof(*addr)); - fpurstor(get_pcb_user_save_td(td)); - critical_exit(); - pcb->pcb_flags |= PCB_NPXUSERINITDONE | PCB_NPXINITDONE; } else { - critical_exit(); error = npxsetxstate(td, xfpustate, xfpustate_size); - if (error != 0) - return (error); - bcopy(addr, get_pcb_user_save_td(td), sizeof(*addr)); - npxuserinited(td); + if (error == 0) { + bcopy(addr, get_pcb_user_save_td(td), sizeof(*addr)); + npxuserinited(td); + } } - return (0); + critical_exit(); + return (error); } static void @@ -1373,6 +1373,7 @@ fpu_kern_enter(struct thread *td, struct fpu_kern_ctx return (0); } pcb = td->td_pcb; + critical_enter(); KASSERT(!PCB_USER_FPU(pcb) || pcb->pcb_save == get_pcb_user_save_pcb(pcb), ("mangled pcb_save")); ctx->flags = FPU_KERN_CTX_INUSE; @@ -1383,6 +1384,7 @@ fpu_kern_enter(struct thread *td, struct fpu_kern_ctx pcb->pcb_save = fpu_kern_ctx_savefpu(ctx); pcb->pcb_flags |= PCB_KERNNPX; pcb->pcb_flags &= ~PCB_NPXINITDONE; + critical_exit(); return (0); } @@ -1401,7 +1403,6 @@ fpu_kern_leave(struct thread *td, struct fpu_kern_ctx critical_enter(); if (curthread == PCPU_GET(fpcurthread)) npxdrop(); - critical_exit(); pcb->pcb_save = ctx->prev; if (pcb->pcb_save == get_pcb_user_save_pcb(pcb)) { if ((pcb->pcb_flags & PCB_NPXUSERINITDONE) != 0) @@ -1416,6 +1417,7 @@ fpu_kern_leave(struct thread *td, struct fpu_kern_ctx pcb->pcb_flags &= ~PCB_NPXINITDONE; KASSERT(!PCB_USER_FPU(pcb), ("unpaired fpu_kern_leave")); } + critical_exit(); return (0); }