Re: [PATCH] x86/fpu: Delay instruction pointer fixup until after after warning

[Chao Gao]

nit: s/after after/after/ in the subject line

On Wed, Jun 18, 2025 at 12:33:13PM -0700, Dave Hansen wrote:
>
>From: Dave Hansen <dave.hansen@xxxxxxxxxxxxxxx>
>
>Right now, if XRSTOR fails a console message like this is be printed:
>
>	Bad FPU state detected at restore_fpregs_from_fpstate+0x9a/0x170, reinitializing FPU registers.
>
>However, the text location (...+0x9a in this case) is the instruction
>*AFTER* the XRSTOR. The highlighted instruction in the "Code:" dump
>also points one instruction late.
>
>The reason is that the "fixup" moves RIP up to pass the bad XRSTOR
>and keep on running after returning from the #GP handler. But it
>does this fixup before warning.
>
>The resulting warning output is nonsensical because it looks like
>e non-FPU-related instruction is #GP'ing.
>
>Do not fix up RIP until after printing the warning.
>
>Signed-off-by: Dave Hansen <dave.hansen@xxxxxxxxxxxxxxx>
>Fixes: d5c8028b4788 ("x86/fpu: Reinitialize FPU registers if restoring FPU state fails")
>Cc: stable@xxxxxxxxxxxxxxx
>Cc: Eric Biggers <ebiggers@xxxxxxxxxx>
>Cc: Rik van Riel <riel@xxxxxxxxxx>
>Cc: Borislav Petkov <bp@xxxxxxxxx>
>Cc: Chang S. Bae <chang.seok.bae@xxxxxxxxx>
>---
>
> b/arch/x86/mm/extable.c |    4 ++--
> 1 file changed, 2 insertions(+), 2 deletions(-)
>
>diff -puN arch/x86/mm/extable.c~fixup-fpu-gp-ip-later arch/x86/mm/extable.c
>--- a/arch/x86/mm/extable.c~fixup-fpu-gp-ip-later	2025-06-18 12:21:30.231719499 -0700
>+++ b/arch/x86/mm/extable.c	2025-06-18 12:25:53.979954060 -0700
>@@ -122,11 +122,11 @@ static bool ex_handler_sgx(const struct
> static bool ex_handler_fprestore(const struct exception_table_entry *fixup,
> 				 struct pt_regs *regs)
> {
>-	regs->ip = ex_fixup_addr(fixup);
>-
> 	WARN_ONCE(1, "Bad FPU state detected at %pB, reinitializing FPU registers.",
> 		  (void *)instruction_pointer(regs));
> 
>+	regs->ip = ex_fixup_addr(fixup);
>+

instead of delaying the RIP fixup,

> 	fpu_reset_from_exception_fixup();
> 	return true;

can we do

	return ex_handler_default(fixup, regs);

here? Similar to what other handlers ex_handler_{fault, sgx, uaccess, ...} are
doing.

> }
>_