git: 2f9a4885ec99 - stable/14 - amd64: do not allow to set reserved bits in MXCSR for ptrace(PT_SETFPREGS)

The branch stable/14 has been updated by kib:

URL: https://cgit.FreeBSD.org/src/commit/?id=2f9a4885ec995e8ea53b42a820fbd9c337a2a907

commit 2f9a4885ec995e8ea53b42a820fbd9c337a2a907
Author:     Konstantin Belousov <[email protected]>
AuthorDate: 2026-07-30 03:57:34 +0000
Commit:     Konstantin Belousov <[email protected]>
CommitDate: 2026-08-05 06:23:16 +0000

    amd64: do not allow to set reserved bits in MXCSR for ptrace(PT_SETFPREGS)
    
    (cherry picked from commit cef05c5a62ba63eda222eed083972bfaa1449ac2)
---
 sys/amd64/amd64/exec_machdep.c | 17 ++++++++++++-----
 1 file changed, 12 insertions(+), 5 deletions(-)

diff --git a/sys/amd64/amd64/exec_machdep.c b/sys/amd64/amd64/exec_machdep.c
index b9c69b7d5a2f..0158afda247f 100644
--- a/sys/amd64/amd64/exec_machdep.c
+++ b/sys/amd64/amd64/exec_machdep.c
@@ -533,13 +533,16 @@ fill_fpregs_xmm(struct savefpu *sv_xmm, struct fpreg *fpregs)
 }
 
 /* internalize from fpregs into sv_xmm */
-static void
+static int
 set_fpregs_xmm(struct fpreg *fpregs, struct savefpu *sv_xmm)
 {
 	struct envxmm *penv_xmm = &sv_xmm->sv_env;
 	struct envxmm *penv_fpreg = (struct envxmm *)&fpregs->fpr_env;
 	int i;
 
+	if ((penv_fpreg->en_mxcsr & ~cpu_mxcsr_mask) != 0)
+		return (EINVAL);
+
 	/* fpregs -> pcb */
 	/* FPU control/status */
 	penv_xmm->en_cw = penv_fpreg->en_cw;
@@ -549,7 +552,7 @@ set_fpregs_xmm(struct fpreg *fpregs, struct savefpu *sv_xmm)
 	penv_xmm->en_rip = penv_fpreg->en_rip;
 	penv_xmm->en_rdp = penv_fpreg->en_rdp;
 	penv_xmm->en_mxcsr = penv_fpreg->en_mxcsr;
-	penv_xmm->en_mxcsr_mask = penv_fpreg->en_mxcsr_mask & cpu_mxcsr_mask;
+	penv_xmm->en_mxcsr_mask = penv_fpreg->en_mxcsr_mask;
 
 	/* FPU registers */
 	for (i = 0; i < 8; ++i)
@@ -558,6 +561,8 @@ set_fpregs_xmm(struct fpreg *fpregs, struct savefpu *sv_xmm)
 	/* SSE registers */
 	for (i = 0; i < 16; ++i)
 		bcopy(fpregs->fpr_xacc[i], sv_xmm->sv_xmm[i].xmm_bytes, 16);
+
+	return (0);
 }
 
 /* externalize from td->pcb */
@@ -577,12 +582,14 @@ fill_fpregs(struct thread *td, struct fpreg *fpregs)
 int
 set_fpregs(struct thread *td, struct fpreg *fpregs)
 {
+	int error;
 
 	critical_enter();
-	set_fpregs_xmm(fpregs, get_pcb_user_save_td(td));
-	fpuuserinited(td);
+	error = set_fpregs_xmm(fpregs, get_pcb_user_save_td(td));
+	if (error == 0)
+		fpuuserinited(td);
 	critical_exit();
-	return (0);
+	return (error);
 }
 
 /*