linux-kernel - Re: [PATCH v2] arm64: armv8_deprecated: Fix undef

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <f2c442f8-d2b6-c859-ca1a-2b8a343047e6@arm.com>
Date:   Wed, 8 Apr 2020 12:39:50 +0100
From:   Suzuki K Poulose <suzuki.poulose@....com>
To:     fredrik@...upe.net, catalin.marinas@....com
Cc:     linux-kernel@...r.kernel.org, linux-arm-kernel@...ts.infradead.org,
        will.deacon@....com
Subject: Re: [PATCH v2] arm64: armv8_deprecated: Fix undef_hook mask for thumb
 setend

On 04/08/2020 12:29 PM, Fredrik Strupe wrote:
> For thumb instructions, call_undef_hook() in traps.c first reads a u16,
> and if the u16 indicates a T32 instruction (u16 >= 0xe800), a second
> u16 is read, which then makes up the the lower half-word of a T32
> instruction. For T16 instructions, the second u16 is not read,
> which makes the resulting u32 opcode always have the upper half set to
> 0.
> 
> However, having the upper half of instr_mask in the undef_hook set to 0
> masks out the upper half of all thumb instructions - both T16 and T32.
> This results in trapped T32 instructions with the lower half-word equal
> to the T16 encoding of setend (b650) being matched, even though the upper
> half-word is not 0000 and thus indicates a T32 opcode.
> 
> An example of such a T32 instruction is eaa0b650, which should raise a
> SIGILL since T32 instructions with an eaa prefix are unallocated as per
> Arm ARM, but instead works as a SETEND because the second half-word is set
> to b650.
> 
> This patch fixes the issue by extending instr_mask to include the
> upper u32 half, which will still match T16 instructions where the upper
> half is 0, but not T32 instructions.
> 
> Signed-off-by: Fredrik Strupe <fredrik@...upe.net>
> Cc: Catalin Marinas <catalin.marinas@....com>
> Cc: Will Deacon <will.deacon@....com>
> Fixes: 2d888f48e056 ("arm64: Emulate SETEND for AArch32 tasks")
> ---
>   arch/arm64/kernel/armv8_deprecated.c | 2 +-
>   1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/arch/arm64/kernel/armv8_deprecated.c b/arch/arm64/kernel/armv8_deprecated.c
> index 9d3442d62..8c06dfee0 100644
> --- a/arch/arm64/kernel/armv8_deprecated.c
> +++ b/arch/arm64/kernel/armv8_deprecated.c
> @@ -609,7 +609,7 @@ static struct undef_hook setend_hooks[] = {
>   	},
>   	{
>   		/* Thumb mode */
> -		.instr_mask	= 0x0000fff7,
> +		.instr_mask	= 0xfffffff7,
>   		.instr_val	= 0x0000b650,
>   		.pstate_mask	= (PSR_AA32_T_BIT | PSR_AA32_MODE_MASK),
>   		.pstate_val	= (PSR_AA32_T_BIT | PSR_AA32_MODE_USR),
> 

Reviewed-by : Suzuki K Poulose <suzuki.poulose@....com>