linux-kernel - Re: [PATCH v2 2/3] objtool,x86: Additionally decode: mov %rsp, (%reg)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 9 Feb 2021 10:32:55 -0600
From:   Josh Poimboeuf <jpoimboe@...hat.com>
To:     Peter Zijlstra <peterz@...radead.org>
Cc:     Thomas Gleixner <tglx@...utronix.de>,
        Miroslav Benes <mbenes@...e.cz>,
        Nick Desaulniers <ndesaulniers@...gle.com>,
        Julien Thierry <jthierry@...hat.com>,
        Kees Cook <keescook@...omium.org>, x86@...nel.org,
        linux-kernel@...r.kernel.org
Subject: Re: [PATCH v2 2/3] objtool,x86: Additionally decode: mov %rsp, (%reg)

On Tue, Feb 09, 2021 at 10:16:02AM +0100, Peter Zijlstra wrote:
> Where we already decode: mov %rsp, %reg, also decode mov %rsp, (%reg).
> 
> Nothing should match for this new stack-op.
> 
> Signed-off-by: Peter Zijlstra (Intel) <peterz@...radead.org>
> ---
>  tools/objtool/arch/x86/decode.c |   23 ++++++++++++++++++-----
>  1 file changed, 18 insertions(+), 5 deletions(-)
> 
> --- a/tools/objtool/arch/x86/decode.c
> +++ b/tools/objtool/arch/x86/decode.c
> @@ -222,14 +222,24 @@ int arch_decode_instruction(const struct
>  		break;
>  
>  	case 0x89:
> -		if (rex_w && !rex_r && modrm_mod == 3 && modrm_reg == 4) {
> +		if (rex_w && !rex_r && modrm_reg == 4) {
>  
> -			/* mov %rsp, reg */
> +			/* mov %rsp, */
>  			ADD_OP(op) {
>  				op->src.type = OP_SRC_REG;
>  				op->src.reg = CFI_SP;
> -				op->dest.type = OP_DEST_REG;
> -				op->dest.reg = op_to_cfi_reg[modrm_rm][rex_b];
> +				if (modrm_mod == 3) {
> +
> +					/* mov %rsp, reg */
> +					op->dest.type = OP_DEST_REG;
> +					op->dest.reg = op_to_cfi_reg[modrm_rm][rex_b];
> +
> +				} else if (modrm_mod == 0) {
> +
> +					/* mov %rsp, (%reg) */
> +					op->dest.type = OP_DEST_REG_INDIRECT;
> +					op->dest.reg = op_to_cfi_reg[modrm_rm][rex_b];
> +				}

What if modrm_mod is 1 or 2?   Should 'if' below the 'case' make sure
it's 0 or 3?

>  			}
>  			break;
>  		}
> @@ -259,8 +269,10 @@ int arch_decode_instruction(const struct
>  				op->dest.reg = CFI_BP;
>  				op->dest.offset = insn.displacement.value;
>  			}
> +			break;
> +		}
>  
> -		} else if (rex_w && !rex_b && modrm_rm == 4 && sib == 0x24) {
> +		if (rex_w && !rex_b && modrm_rm == 4 && sib == 0x24) {
>  
>  			/* mov reg, disp(%rsp) */
>  			ADD_OP(op) {
> @@ -270,6 +282,7 @@ int arch_decode_instruction(const struct
>  				op->dest.reg = CFI_SP;
>  				op->dest.offset = insn.displacement.value;
>  			}
> +			break;
>  		}
>  
>  		break;
> 

Did this change have a point?

-- 
Josh