Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 609a2d65 authored by Masami Hiramatsu's avatar Masami Hiramatsu Committed by Greg Kroah-Hartman
Browse files

x86/kprobes: Fix to check non boostable prefixes correctly 



[ Upstream commit 6dd3b8c9f58816a1354be39559f630cd1bd12159 ]

There are 2 bugs in the can_boost() function because of using
x86 insn decoder. Since the insn->opcode never has a prefix byte,
it can not find CS override prefix in it. And the insn->attr is
the attribute of the opcode, thus inat_is_address_size_prefix(
insn->attr) always returns false.

Fix those by checking each prefix bytes with for_each_insn_prefix
loop and getting the correct attribute for each prefix byte.
Also, this removes unlikely, because this is a slow path.

Fixes: a8d11cd0 ("kprobes/x86: Consolidate insn decoder users for copying code")
Signed-off-by: default avatarMasami Hiramatsu <mhiramat@kernel.org>
Signed-off-by: default avatarIngo Molnar <mingo@kernel.org>
Link: https://lore.kernel.org/r/161666691162.1120877.2808435205294352583.stgit@devnote2


Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
parent 7a384254

arch/x86/kernel/kprobes/core.c

+12 −5
Original line number Diff line number Diff line
@@ -170,6 +170,8 @@ NOKPROBE_SYMBOL(skip_prefixes); 
int can_boost(struct insn *insn, void *addr)

{

	kprobe_opcode_t opcode;

	insn_byte_t prefix;

	int i;



	if (search_exception_tables((unsigned long)addr))

		return 0;	/* Page fault may occur on this address. */
@@ -182,9 +184,14 @@ int can_boost(struct insn *insn, void *addr) 
	if (insn->opcode.nbytes != 1)

		return 0;



	/* Can't boost Address-size override prefix */

	if (unlikely(inat_is_address_size_prefix(insn->attr)))

	for_each_insn_prefix(insn, i, prefix) {

		insn_attr_t attr;



		attr = inat_get_opcode_attribute(prefix);

		/* Can't boost Address-size override prefix and CS override prefix */

		if (prefix == 0x2e || inat_is_address_size_prefix(attr))

			return 0;

	}



	opcode = insn->opcode.bytes[0];
@@ -209,8 +216,8 @@ int can_boost(struct insn *insn, void *addr) 
		/* clear and set flags are boostable */

		return (opcode == 0xf5 || (0xf7 < opcode && opcode < 0xfe));

	default:

		/* CS override prefix and call are not boostable */

		return (opcode != 0x2e && opcode != 0x9a);

		/* call is not boostable */

		return opcode != 0x9a;

	}

}