Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 5a91fa53 authored by Masami Hiramatsu's avatar Masami Hiramatsu Committed by Greg Kroah-Hartman
Browse files

x86/uprobes: Do not use prefixes.nbytes when looping over prefixes.bytes 



commit 4e9a5ae8df5b3365183150f6df49e49dece80d8c upstream

Since insn.prefixes.nbytes can be bigger than the size of
insn.prefixes.bytes[] when a prefix is repeated, the proper check must
be

  insn.prefixes.bytes[i] != 0 and i < 4

instead of using insn.prefixes.nbytes.

Introduce a for_each_insn_prefix() macro for this purpose. Debugged by
Kees Cook <keescook@chromium.org>.

 [ bp: Massage commit message, sync with the respective header in tools/
   and drop "we". ]

Fixes: 2b144498 ("uprobes, mm, x86: Add the ability to install and remove uprobes breakpoints")
Reported-by: default avatar <syzbot+9b64b619f10f19d19a7c@syzkaller.appspotmail.com>
Signed-off-by: default avatarMasami Hiramatsu <mhiramat@kernel.org>
Signed-off-by: default avatarBorislav Petkov <bp@suse.de>
Reviewed-by: default avatarSrikar Dronamraju <srikar@linux.vnet.ibm.com>
Cc: stable@vger.kernel.org
Link: https://lkml.kernel.org/r/160697103739.3146288.7437620795200799020.stgit@devnote2


[sudip: adjust context, use old insn.h]
Signed-off-by: default avatarSudip Mukherjee <sudipm.mukherjee@gmail.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent cad39416

arch/x86/include/asm/insn.h

+15 −0
Original line number Diff line number Diff line
@@ -208,6 +208,21 @@ static inline int insn_offset_immediate(struct insn *insn) 
	return insn_offset_displacement(insn) + insn->displacement.nbytes;

}



/**

 * for_each_insn_prefix() -- Iterate prefixes in the instruction

 * @insn: Pointer to struct insn.

 * @idx:  Index storage.

 * @prefix: Prefix byte.

 *

 * Iterate prefix bytes of given @insn. Each prefix byte is stored in @prefix

 * and the index is stored in @idx (note that this @idx is just for a cursor,

 * do not change it.)

 * Since prefixes.nbytes can be bigger than 4 if some prefixes

 * are repeated, it cannot be used for looping over the prefixes.

 */

#define for_each_insn_prefix(insn, idx, prefix)	\

	for (idx = 0; idx < ARRAY_SIZE(insn->prefixes.bytes) && (prefix = insn->prefixes.bytes[idx]) != 0; idx++)



#define POP_SS_OPCODE 0x1f

#define MOV_SREG_OPCODE 0x8e

arch/x86/kernel/uprobes.c

+6 −4
Original line number Diff line number Diff line
@@ -268,10 +268,11 @@ static volatile u32 good_2byte_insns[256 / 32] = { 


static bool is_prefix_bad(struct insn *insn)

{

	insn_byte_t p;

	int i;



	for (i = 0; i < insn->prefixes.nbytes; i++) {

		switch (insn->prefixes.bytes[i]) {

	for_each_insn_prefix(insn, i, p) {

		switch (p) {

		case 0x26:	/* INAT_PFX_ES   */

		case 0x2E:	/* INAT_PFX_CS   */

		case 0x36:	/* INAT_PFX_DS   */
@@ -711,6 +712,7 @@ static const struct uprobe_xol_ops branch_xol_ops = { 
static int branch_setup_xol_ops(struct arch_uprobe *auprobe, struct insn *insn)

{

	u8 opc1 = OPCODE1(insn);

	insn_byte_t p;

	int i;



	switch (opc1) {
@@ -741,8 +743,8 @@ static int branch_setup_xol_ops(struct arch_uprobe *auprobe, struct insn *insn) 
	 * Intel and AMD behavior differ in 64-bit mode: Intel ignores 66 prefix.

	 * No one uses these insns, reject any branch insns with such prefix.

	 */

	for (i = 0; i < insn->prefixes.nbytes; i++) {

		if (insn->prefixes.bytes[i] == 0x66)

	for_each_insn_prefix(insn, i, p) {

		if (p == 0x66)

			return -ENOTSUPP;

	}

tools/objtool/arch/x86/include/asm/insn.h

+15 −0
Original line number Diff line number Diff line
@@ -208,4 +208,19 @@ static inline int insn_offset_immediate(struct insn *insn) 
	return insn_offset_displacement(insn) + insn->displacement.nbytes;

}



/**

 * for_each_insn_prefix() -- Iterate prefixes in the instruction

 * @insn: Pointer to struct insn.

 * @idx:  Index storage.

 * @prefix: Prefix byte.

 *

 * Iterate prefix bytes of given @insn. Each prefix byte is stored in @prefix

 * and the index is stored in @idx (note that this @idx is just for a cursor,

 * do not change it.)

 * Since prefixes.nbytes can be bigger than 4 if some prefixes

 * are repeated, it cannot be used for looping over the prefixes.

 */

#define for_each_insn_prefix(insn, idx, prefix)        \

	for (idx = 0; idx < ARRAY_SIZE(insn->prefixes.bytes) && (prefix = insn->prefixes.bytes[idx]) != 0; idx++)



#endif /* _ASM_X86_INSN_H */