Re: [PATCH 05/10] x86/fpu: Fix potential underflow in xstate_calculate_size()
"Chang S. Bae" <[email protected]> Tue, 30 Jun 2026 12:23:51 -0700
| Newsgroups | dev.linux.lists.criu,org.kernel.vger.linux-kernel |
|---|---|
| Message-ID | <[email protected]> |
On 6/15/2026 12:37 PM, Andrei Vagin wrote: > xstate_calculate_size() calculates the size required for a given set of > xfeatures. It determines the topmost feature by finding the most > significant bit in xfeatures using fls64(xfeatures) - 1. > > If xfeatures is 0, fls64(0) returns 0, and topmost becomes -1. > Previously, topmost was unsigned int, so -1 underflowed to UINT_MAX. > This caused the subsequent check `topmost <= XFEATURE_SSE` to fail, and > the code proceeded to access xstate arrays using topmost (UINT_MAX) as > an index, leading to an out-of-bounds access. > > Fix this by checking if xfeatures only contains legacy features (FP/SSE) > or is empty (xfeatures <= XFEATURE_MASK_FPSSE) before calculating > topmost. Just a nit: this appears to prepare for the changes in patch7. If so, it may make sense to move it just before that?