linux-kernel - [PATCH 3.16 095/133] MIPS: microMIPS: Fix decoding of swsp16 instruction

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <lsq.1511315893.265961265@decadent.org.uk>
Date:   Wed, 22 Nov 2017 01:58:13 +0000
From:   Ben Hutchings <ben@...adent.org.uk>
To:     linux-kernel@...r.kernel.org, stable@...r.kernel.org
CC:     akpm@...ux-foundation.org, linux-mips@...ux-mips.org,
        "Matt Redfearn" <matt.redfearn@...tec.com>,
        "Ralf Baechle" <ralf@...ux-mips.org>,
        "Marcin Nowakowski" <marcin.nowakowski@...tec.com>,
        "James Hogan" <james.hogan@...tec.com>,
        "Miodrag Dinic" <miodrag.dinic@...tec.com>,
        "Paul Burton" <paul.burton@...tec.com>,
        "David Daney" <david.daney@...ium.com>,
        "Ingo Molnar" <mingo@...nel.org>
Subject: [PATCH 3.16 095/133] MIPS: microMIPS: Fix decoding of swsp16
 instruction

3.16.51-rc1 review patch.  If anyone has any objections, please let me know.

------------------

From: Matt Redfearn <matt.redfearn@...tec.com>

commit cea8cd498f4f1c30ea27e3664b3c671e495c4fce upstream.

When the immediate encoded in the instruction is accessed, it is sign
extended due to being a signed value being assigned to a signed integer.
The ISA specifies that this operation is an unsigned operation.
The sign extension leads us to incorrectly decode:

801e9c8e:       cbf1            sw      ra,68(sp)

As having an immediate of 1073741809.

Since the instruction format does not specify signed/unsigned, and this
is currently the only location to use this instuction format, change it
to an unsigned immediate.

Fixes: bb9bc4689b9c ("MIPS: Calculate microMIPS ra properly when unwinding the stack")
Suggested-by: Paul Burton <paul.burton@...tec.com>
Signed-off-by: Matt Redfearn <matt.redfearn@...tec.com>
Reviewed-by: James Hogan <james.hogan@...tec.com>
Cc: Marcin Nowakowski <marcin.nowakowski@...tec.com>
Cc: Miodrag Dinic <miodrag.dinic@...tec.com>
Cc: Ingo Molnar <mingo@...nel.org>
Cc: David Daney <david.daney@...ium.com>
Cc: linux-mips@...ux-mips.org
Cc: linux-kernel@...r.kernel.org
Patchwork: https://patchwork.linux-mips.org/patch/16957/
Signed-off-by: Ralf Baechle <ralf@...ux-mips.org>
Signed-off-by: Ben Hutchings <ben@...adent.org.uk>
---
 arch/mips/include/uapi/asm/inst.h | 2 +-
 arch/mips/kernel/process.c        | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

--- a/arch/mips/include/uapi/asm/inst.h
+++ b/arch/mips/include/uapi/asm/inst.h
@@ -808,7 +808,7 @@ struct mm16_r3_format {		/* Load from gl
 struct mm16_r5_format {		/* Load/store from stack pointer format */
 	__BITFIELD_FIELD(unsigned int opcode : 6,
 	__BITFIELD_FIELD(unsigned int rt : 5,
-	__BITFIELD_FIELD(signed int simmediate : 5,
+	__BITFIELD_FIELD(unsigned int imm : 5,
 	__BITFIELD_FIELD(unsigned int : 16, /* Ignored */
 	;))))
 };
--- a/arch/mips/kernel/process.c
+++ b/arch/mips/kernel/process.c
@@ -241,7 +241,7 @@ static inline int is_ra_save_ins(union m
 			if (ip->mm16_r5_format.rt != 31)
 				return 0;
 
-			*poff = ip->mm16_r5_format.simmediate;
+			*poff = ip->mm16_r5_format.imm;
 			*poff = (*poff << 2) / sizeof(ulong);
 			return 1;