| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <tip-ff9d78025c519046cfbc212b34f09116685402fc@git.kernel.org>
Date: Wed, 1 Nov 2017 13:57:28 -0700
From: tip-bot for Ricardo Neri <tipbot@...or.com>
To: linux-tip-commits@...r.kernel.org
Cc: hpa@...or.com, adam.buchbinder@...il.com, qiaowei.ren@...el.com,
tglx@...utronix.de, ray.huang@....com, cmetcalf@...lanox.com,
dave.hansen@...ux.intel.com, shuah@...nel.org, lstoakes@...il.com,
colin.king@...onical.com, slaoub@...il.com, corbet@....net,
bp@...e.de, mhiramat@...nel.org, ravi.v.shankar@...el.com,
joe@...ches.com, adanhawthorn@...il.com, akpm@...ux-foundation.org,
liverlint@...il.com, peterz@...radead.org, luto@...nel.org,
vbabka@...e.cz, paul.gortmaker@...driver.com, mingo@...nel.org,
pbonzini@...hat.com, jslaby@...e.cz, brgerst@...il.com,
mst@...hat.com, ricardo.neri-calderon@...ux.intel.com,
linux-kernel@...r.kernel.org
Subject: [tip:x86/mpx] x86/mpx: Do not use SIB.index if its value is 100b
and ModRM.mod is not 11b
Commit-ID: ff9d78025c519046cfbc212b34f09116685402fc
Gitweb: https://git.kernel.org/tip/ff9d78025c519046cfbc212b34f09116685402fc
Author: Ricardo Neri <ricardo.neri-calderon@...ux.intel.com>
AuthorDate: Fri, 27 Oct 2017 13:25:34 -0700
Committer: Thomas Gleixner <tglx@...utronix.de>
CommitDate: Wed, 1 Nov 2017 21:50:09 +0100
x86/mpx: Do not use SIB.index if its value is 100b and ModRM.mod is not 11b
Section 2.2.1.2 of the Intel 64 and IA-32 Architectures Software
Developer's Manual volume 2A states that when ModRM.mod !=11b and
ModRM.rm = 100b indexed register-indirect addressing is used. In other
words, a SIB byte follows the ModRM byte. In the specific case of
SIB.index = 100b, the scale*index portion of the computation of the
effective address is null. To signal callers of this particular situation,
get_reg_offset() can return -EDOM (-EINVAL continues to indicate that an
error when decoding the SIB byte).
An example of this situation can be the following instruction:
8b 4c 23 80 mov -0x80(%rbx,%riz,1),%rcx
ModRM: 0x4c [mod:1b][reg:1b][rm:100b]
SIB: 0x23 [scale:0b][index:100b][base:11b]
Displacement: 0x80 (1-byte, as per ModRM.mod = 1b)
The %riz 'register' indicates a null index.
In long mode, a REX prefix may be used. When a REX prefix is present,
REX.X adds a fourth bit to the register selection of SIB.index. This gives
the ability to refer to all the 16 general purpose registers. When REX.X is
1b and SIB.index is 100b, the index is indicated in %r12. In our example,
this would look like:
42 8b 4c 23 80 mov -0x80(%rbx,%r12,1),%rcx
REX: 0x42 [W:0b][R:0b][X:1b][B:0b]
ModRM: 0x4c [mod:1b][reg:1b][rm:100b]
SIB: 0x23 [scale:0b][.X: 1b, index:100b][.B:0b, base:11b]
Displacement: 0x80 (1-byte, as per ModRM.mod = 1b)
%r12 is a valid register to use in the scale*index part of the effective
address computation.
Signed-off-by: Ricardo Neri <ricardo.neri-calderon@...ux.intel.com>
Signed-off-by: Thomas Gleixner <tglx@...utronix.de>
Reviewed-by: Borislav Petkov <bp@...e.de>
Cc: Adan Hawthorn <adanhawthorn@...il.com>
Cc: "Michael S. Tsirkin" <mst@...hat.com>
Cc: Peter Zijlstra <peterz@...radead.org>
Cc: Dave Hansen <dave.hansen@...ux.intel.com>
Cc: ricardo.neri@...el.com
Cc: Paul Gortmaker <paul.gortmaker@...driver.com>
Cc: Huang Rui <ray.huang@....com>
Cc: Qiaowei Ren <qiaowei.ren@...el.com>
Cc: Shuah Khan <shuah@...nel.org>
Cc: Jonathan Corbet <corbet@....net>
Cc: Jiri Slaby <jslaby@...e.cz>
Cc: Nathan Howard <liverlint@...il.com>
Cc: "Ravi V. Shankar" <ravi.v.shankar@...el.com>
Cc: Chris Metcalf <cmetcalf@...lanox.com>
Cc: Brian Gerst <brgerst@...il.com>
Cc: Andy Lutomirski <luto@...nel.org>
Cc: Colin Ian King <colin.king@...onical.com>
Cc: Chen Yucong <slaoub@...il.com>
Cc: Adam Buchbinder <adam.buchbinder@...il.com>
Cc: Vlastimil Babka <vbabka@...e.cz>
Cc: Lorenzo Stoakes <lstoakes@...il.com>
Cc: Masami Hiramatsu <mhiramat@...nel.org>
Cc: Joe Perches <joe@...ches.com>
Cc: Paolo Bonzini <pbonzini@...hat.com>
Cc: Andrew Morton <akpm@...ux-foundation.org>
Link: https://lkml.kernel.org/r/1509135945-13762-8-git-send-email-ricardo.neri-calderon@linux.intel.com
---
arch/x86/mm/mpx.c | 21 +++++++++++++++++++--
1 file changed, 19 insertions(+), 2 deletions(-)
diff --git a/arch/x86/mm/mpx.c b/arch/x86/mm/mpx.c
index 57e5bf5..2ad1d4a 100644
--- a/arch/x86/mm/mpx.c
+++ b/arch/x86/mm/mpx.c
@@ -110,6 +110,15 @@ static int get_reg_offset(struct insn *insn, struct pt_regs *regs,
regno = X86_SIB_INDEX(insn->sib.value);
if (X86_REX_X(insn->rex_prefix.value))
regno += 8;
+
+ /*
+ * If ModRM.mod != 3 and SIB.index = 4 the scale*index
+ * portion of the address computation is null. This is
+ * true only if REX.X is 0. In such a case, the SIB index
+ * is used in the address computation.
+ */
+ if (X86_MODRM_MOD(insn->modrm.value) != 3 && regno == 4)
+ return -EDOM;
break;
case REG_TYPE_BASE:
@@ -160,11 +169,19 @@ static void __user *mpx_get_addr_ref(struct insn *insn, struct pt_regs *regs)
goto out;
indx_offset = get_reg_offset(insn, regs, REG_TYPE_INDEX);
- if (indx_offset < 0)
+ /*
+ * A negative offset generally means a error, except
+ * -EDOM, which means that the contents of the register
+ * should not be used as index.
+ */
+ if (indx_offset == -EDOM)
+ indx = 0;
+ else if (indx_offset < 0)
goto out;
+ else
+ indx = regs_get_register(regs, indx_offset);
base = regs_get_register(regs, base_offset);
- indx = regs_get_register(regs, indx_offset);
eff_addr = base + indx * (1 << X86_SIB_SCALE(sib));
} else {
Powered by blists - more mailing lists