| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <tip-7a6daf79123a086f03b8cdfbc953958c8e1c1287@git.kernel.org>
Date: Wed, 8 Nov 2017 02:58:16 -0800
From: tip-bot for Ricardo Neri <tipbot@...or.com>
To: linux-tip-commits@...r.kernel.org
Cc: dave.hansen@...ux.intel.com, keescook@...omium.org,
lstoakes@...il.com, thgarnie@...gle.com, jslaby@...e.cz,
brgerst@...il.com, ray.huang@....com, peterz@...radead.org,
adam.buchbinder@...il.com, tony.luck@...el.com, dvyukov@...gle.com,
dvlasenk@...hat.com, slaoub@...il.com, qiaowei.ren@...el.com,
ricardo.neri-calderon@...ux.intel.com, akpm@...ux-foundation.org,
vbabka@...e.cz, ravi.v.shankar@...el.com, luto@...nel.org,
mingo@...nel.org, tglx@...utronix.de, corbet@....net,
mhiramat@...nel.org, paul.gortmaker@...driver.com,
cmetcalf@...lanox.com, pbonzini@...hat.com, bp@...en8.de,
acme@...hat.com, hpa@...or.com, colin.king@...onical.com,
mst@...hat.com, adrian.hunter@...el.com,
linux-kernel@...r.kernel.org, shuah@...nel.org,
torvalds@...ux-foundation.org, jpoimboe@...hat.com, bp@...e.de
Subject: [tip:x86/asm] x86/insn-eval: Add support to resolve 32-bit address
encodings
Commit-ID: 7a6daf79123a086f03b8cdfbc953958c8e1c1287
Gitweb: https://git.kernel.org/tip/7a6daf79123a086f03b8cdfbc953958c8e1c1287
Author: Ricardo Neri <ricardo.neri-calderon@...ux.intel.com>
AuthorDate: Sun, 5 Nov 2017 18:27:47 -0800
Committer: Ingo Molnar <mingo@...nel.org>
CommitDate: Wed, 8 Nov 2017 11:16:19 +0100
x86/insn-eval: Add support to resolve 32-bit address encodings
32-bit and 64-bit address encodings are identical. Thus, the same logic
could be used to resolve the effective address. However, there are two key
differences: address size and enforcement of segment limits.
If running a 32-bit process on a 64-bit kernel, it is best to perform
the address calculation using 32-bit data types. In this manner hardware
is used for the arithmetic, including handling of signs and overflows.
32-bit addresses are generally used in protected mode; segment limits are
enforced in this mode. This implementation obtains the limit of the
segment associated with the instruction operands and prefixes. If the
computed address is outside the segment limits, an error is returned. It
is also possible to use 32-bit address in long mode and virtual-8086 mode
by using an address override prefix. In such cases, segment limits are not
enforced.
Support to use 32-bit arithmetic is added to the utility functions that
compute effective addresses. However, the end result is stored in a
variable of type long (which has a width of 8 bytes in 64-bit builds).
Hence, once a 32-bit effective address is computed, the 4 most significant
bytes are masked out to avoid sign extension.
The newly added function get_addr_ref_32() is almost identical to the
existing function insn_get_addr_ref() (used for 64-bit addresses). The only
difference is that it verifies that the effective address is within the
limits of the segment.
Signed-off-by: Ricardo Neri <ricardo.neri-calderon@...ux.intel.com>
Reviewed-by: Thomas Gleixner <tglx@...utronix.de>
Cc: Adam Buchbinder <adam.buchbinder@...il.com>
Cc: Adrian Hunter <adrian.hunter@...el.com>
Cc: Andrew Morton <akpm@...ux-foundation.org>
Cc: Andy Lutomirski <luto@...nel.org>
Cc: Arnaldo Carvalho de Melo <acme@...hat.com>
Cc: Borislav Petkov <bp@...en8.de>
Cc: Borislav Petkov <bp@...e.de>
Cc: Brian Gerst <brgerst@...il.com>
Cc: Chen Yucong <slaoub@...il.com>
Cc: Chris Metcalf <cmetcalf@...lanox.com>
Cc: Colin Ian King <colin.king@...onical.com>
Cc: Dave Hansen <dave.hansen@...ux.intel.com>
Cc: Denys Vlasenko <dvlasenk@...hat.com>
Cc: Dmitry Vyukov <dvyukov@...gle.com>
Cc: H. Peter Anvin <hpa@...or.com>
Cc: Huang Rui <ray.huang@....com>
Cc: Jiri Slaby <jslaby@...e.cz>
Cc: Jonathan Corbet <corbet@....net>
Cc: Josh Poimboeuf <jpoimboe@...hat.com>
Cc: Kees Cook <keescook@...omium.org>
Cc: Linus Torvalds <torvalds@...ux-foundation.org>
Cc: Lorenzo Stoakes <lstoakes@...il.com>
Cc: Masami Hiramatsu <mhiramat@...nel.org>
Cc: Michael S. Tsirkin <mst@...hat.com>
Cc: Paolo Bonzini <pbonzini@...hat.com>
Cc: Paul Gortmaker <paul.gortmaker@...driver.com>
Cc: Peter Zijlstra <peterz@...radead.org>
Cc: Qiaowei Ren <qiaowei.ren@...el.com>
Cc: Ravi V. Shankar <ravi.v.shankar@...el.com>
Cc: Shuah Khan <shuah@...nel.org>
Cc: Thomas Garnier <thgarnie@...gle.com>
Cc: Tony Luck <tony.luck@...el.com>
Cc: Vlastimil Babka <vbabka@...e.cz>
Cc: ricardo.neri@...el.com
Link: http://lkml.kernel.org/r/1509935277-22138-3-git-send-email-ricardo.neri-calderon@linux.intel.com
Signed-off-by: Ingo Molnar <mingo@...nel.org>
---
arch/x86/lib/insn-eval.c | 112 ++++++++++++++++++++++++++++++++++++++++++++---
1 file changed, 106 insertions(+), 6 deletions(-)
diff --git a/arch/x86/lib/insn-eval.c b/arch/x86/lib/insn-eval.c
index a4427b4..e6cb68a 100644
--- a/arch/x86/lib/insn-eval.c
+++ b/arch/x86/lib/insn-eval.c
@@ -814,7 +814,11 @@ static int get_eff_addr_reg(struct insn *insn, struct pt_regs *regs,
if (*regoff < 0)
return -EINVAL;
- *eff_addr = regs_get_register(regs, *regoff);
+ /* Ignore bytes that are outside the address size. */
+ if (insn->addr_bytes == 4)
+ *eff_addr = regs_get_register(regs, *regoff) & 0xffffffff;
+ else /* 64-bit address */
+ *eff_addr = regs_get_register(regs, *regoff);
return 0;
}
@@ -846,7 +850,7 @@ static int get_eff_addr_modrm(struct insn *insn, struct pt_regs *regs,
{
long tmp;
- if (insn->addr_bytes != 8)
+ if (insn->addr_bytes != 8 && insn->addr_bytes != 4)
return -EINVAL;
insn_get_modrm(insn);
@@ -875,7 +879,13 @@ static int get_eff_addr_modrm(struct insn *insn, struct pt_regs *regs,
tmp = regs_get_register(regs, *regoff);
}
- *eff_addr = tmp + insn->displacement.value;
+ if (insn->addr_bytes == 4) {
+ int addr32 = (int)(tmp & 0xffffffff) + insn->displacement.value;
+
+ *eff_addr = addr32 & 0xffffffff;
+ } else {
+ *eff_addr = tmp + insn->displacement.value;
+ }
return 0;
}
@@ -908,7 +918,7 @@ static int get_eff_addr_sib(struct insn *insn, struct pt_regs *regs,
long base, indx;
int indx_offset;
- if (insn->addr_bytes != 8)
+ if (insn->addr_bytes != 8 && insn->addr_bytes != 4)
return -EINVAL;
insn_get_modrm(insn);
@@ -946,12 +956,102 @@ static int get_eff_addr_sib(struct insn *insn, struct pt_regs *regs,
else
indx = regs_get_register(regs, indx_offset);
- *eff_addr = base + indx * (1 << X86_SIB_SCALE(insn->sib.value));
+ if (insn->addr_bytes == 4) {
+ int addr32, base32, idx32;
+
+ base32 = base & 0xffffffff;
+ idx32 = indx & 0xffffffff;
- *eff_addr += insn->displacement.value;
+ addr32 = base32 + idx32 * (1 << X86_SIB_SCALE(insn->sib.value));
+ addr32 += insn->displacement.value;
+
+ *eff_addr = addr32 & 0xffffffff;
+ } else {
+ *eff_addr = base + indx * (1 << X86_SIB_SCALE(insn->sib.value));
+ *eff_addr += insn->displacement.value;
+ }
return 0;
}
+
+/**
+ * get_addr_ref_32() - Obtain a 32-bit linear address
+ * @insn: Instruction with ModRM, SIB bytes and displacement
+ * @regs: Register values as seen when entering kernel mode
+ *
+ * This function is to be used with 32-bit address encodings to obtain the
+ * linear memory address referred by the instruction's ModRM, SIB,
+ * displacement bytes and segment base address, as applicable. If in protected
+ * mode, segment limits are enforced.
+ *
+ * Returns:
+ *
+ * Linear address referenced by instruction and registers on success.
+ *
+ * -1L on error.
+ */
+static void __user *get_addr_ref_32(struct insn *insn, struct pt_regs *regs)
+{
+ unsigned long linear_addr = -1L, seg_base, seg_limit;
+ int eff_addr, regoff;
+ long tmp;
+ int ret;
+
+ if (insn->addr_bytes != 4)
+ goto out;
+
+ if (X86_MODRM_MOD(insn->modrm.value) == 3) {
+ ret = get_eff_addr_reg(insn, regs, ®off, &tmp);
+ if (ret)
+ goto out;
+
+ eff_addr = tmp;
+
+ } else {
+ if (insn->sib.nbytes) {
+ ret = get_eff_addr_sib(insn, regs, ®off, &tmp);
+ if (ret)
+ goto out;
+
+ eff_addr = tmp;
+ } else {
+ ret = get_eff_addr_modrm(insn, regs, ®off, &tmp);
+ if (ret)
+ goto out;
+
+ eff_addr = tmp;
+ }
+ }
+
+ ret = get_seg_base_limit(insn, regs, regoff, &seg_base, &seg_limit);
+ if (ret)
+ goto out;
+
+ /*
+ * In protected mode, before computing the linear address, make sure
+ * the effective address is within the limits of the segment.
+ * 32-bit addresses can be used in long and virtual-8086 modes if an
+ * address override prefix is used. In such cases, segment limits are
+ * not enforced. When in virtual-8086 mode, the segment limit is -1L
+ * to reflect this situation.
+ *
+ * After computed, the effective address is treated as an unsigned
+ * quantity.
+ */
+ if (!user_64bit_mode(regs) && ((unsigned int)eff_addr > seg_limit))
+ goto out;
+
+ /*
+ * Data type long could be 64 bits in size. Ensure that our 32-bit
+ * effective address is not sign-extended when computing the linear
+ * address.
+ */
+ linear_addr = (unsigned long)(eff_addr & 0xffffffff) + seg_base;
+
+out:
+ return (void __user *)linear_addr;
+}
+
/*
* return the address being referenced be instruction
* for rm=3 returning the content of the rm reg
Powered by blists - more mailing lists