linux-kernel - Re: [PATCH v2] ARM:unwind:fix unwind abort for uleb128 case

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 13 Apr 2023 15:10:02 +0200
From:   Alexandre Mergnat <amergnat@...libre.com>
To:     Linus Walleij <linus.walleij@...aro.org>,
        Haibo Li <haibo.li@...iatek.com>
Cc:     Russell King <linux@...linux.org.uk>, linux-kernel@...r.kernel.org,
        Matthias Brugger <matthias.bgg@...il.com>,
        AngeloGioacchino Del Regno 
        <angelogioacchino.delregno@...labora.com>,
        xiaoming.yu@...iatek.com,
        Russell King <rmk+kernel@...linux.org.uk>,
        Alex Sverdlin <alexander.sverdlin@...ia.com>,
        linux-arm-kernel@...ts.infradead.org,
        linux-mediatek@...ts.infradead.org, ardb@...nel.org,
        catalin.marinas@....com, a.anurag@...sung.com
Subject: Re: [PATCH v2] ARM:unwind:fix unwind abort for uleb128 case

On 13/04/2023 09:39, Linus Walleij wrote:
> On Thu, Apr 13, 2023 at 9:34 AM Haibo Li<haibo.li@...iatek.com>  wrote:
> 
>> When unwind instruction is 0xb2,the subsequent instructions
>> are uleb128 bytes.
>> For now,it uses only the first uleb128 byte in code.
>>
>> For vsp increments of 0x204~0x400,use one uleb128 byte like below:
>> 0xc06a00e4 <unwind_test_work>: 0x80b27fac
>>    Compact model index: 0
>>    0xb2 0x7f vsp = vsp + 1024
>>    0xac      pop {r4, r5, r6, r7, r8, r14}
>>
>> For vsp increments larger than 0x400,use two uleb128 bytes like below:
>> 0xc06a00e4 <unwind_test_work>: @0xc0cc9e0c
>>    Compact model index: 1
>>    0xb2 0x81 0x01 vsp = vsp + 1032
>>    0xac      pop {r4, r5, r6, r7, r8, r14}
>> The unwind works well since the decoded uleb128 byte is also 0x81.
>>
>> For vsp increments larger than 0x600,use two uleb128 bytes like below:
>> 0xc06a00e4 <unwind_test_work>: @0xc0cc9e0c
>>    Compact model index: 1
>>    0xb2 0x81 0x02 vsp = vsp + 1544
>>    0xac      pop {r4, r5, r6, r7, r8, r14}
>> In this case,the decoded uleb128 result is 0x101(vsp=0x204+(0x101<<2)).
>> While the uleb128 used in code is 0x81(vsp=0x204+(0x81<<2)).
>> The unwind aborts at this frame since it gets incorrect vsp.
>>
>> To fix this,add uleb128 decode to cover all the above case.
>>
>> Signed-off-by: Haibo Li<haibo.li@...iatek.com>
> Thanks Haibo,
> Reviewed-by: Linus Walleij<linus.walleij@...aro.org>

Reviewed-by: Alexandre Mergnat <amergnat@...libre.com>


Regards,
Alexandre