linux-kernel - [PATCH] arm: ptrace: Fix mask for thumb breakpoint hook

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <6ab2ce75-0763-75b1-0d72-ddfb2b9dec19@strupe.net>
Date:   Mon, 16 Mar 2020 13:12:20 +0100
From:   Fredrik Strupe <fredrik@...upe.net>
To:     Oleg Nesterov <oleg@...hat.com>,
        Russell King <linux@...linux.org.uk>,
        linux-arm-kernel@...ts.infradead.org, linux-kernel@...r.kernel.org
Subject: [PATCH] arm: ptrace: Fix mask for thumb breakpoint hook

Since instr_mask in struct undef_hook is 32 bits wide, a mask with value
0xffff will essentially be extended to 0x0000ffff. This makes undefined
thumb2 instructions with the second half-word as 0xde01 generate SIGTRAPs
instead of SIGILLs.

This happens in total for 3143 instructions on my system. An example
of such an instruction is e800de01.

This patch fixes the issue by extending the mask to the full 32 bits,
such that both half-words have to be matched. This will remove all of
the accidental matchings, as 0x0000 is not a valid thumb2 prefix, while
preserving the intended thumb hook.

Signed-off-by: Fredrik Strupe <fredrik@...upe.net>
---
  arch/arm/kernel/ptrace.c | 9 +++++++--
  1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/arch/arm/kernel/ptrace.c b/arch/arm/kernel/ptrace.c
index 36718a424..f51bec0bc 100644
--- a/arch/arm/kernel/ptrace.c
+++ b/arch/arm/kernel/ptrace.c
@@ -228,9 +228,14 @@ static struct undef_hook arm_break_hook = {
  	.fn		= break_trap,
  };

+/*
+ * Set all bits in the instruction mask, even though the thumb
+ * instruction is only 16 bits. This is to prevent accidental
+ * matching of thumb2 instructions.
+ */
  static struct undef_hook thumb_break_hook = {
-	.instr_mask	= 0xffff,
-	.instr_val	= 0xde01,
+	.instr_mask	= 0xffffffff,
+	.instr_val	= 0x0000de01,
  	.cpsr_mask	= PSR_T_BIT,
  	.cpsr_val	= PSR_T_BIT,
  	.fn		= break_trap,
-- 
2.20.1