Messages in this thread Patch in this message | | | From | Ricardo Neri <> | Subject | [PATCH v7 17/26] x86/insn-eval: Handle 32-bit address encodings in virtual-8086 mode | Date | Fri, 5 May 2017 11:17:15 -0700 |
| |
It is possible to utilize 32-bit address encodings in virtual-8086 mode via an address override instruction prefix. However, the range of address is still limited to [0x-0xffff]. In such a case, return error.
Also, linear addresses in virtual-8086 mode are limited to 20 bits. Enforce such limit by truncating the most significant bytes of the computed linear address.
Cc: Dave Hansen <dave.hansen@linux.intel.com> Cc: Adam Buchbinder <adam.buchbinder@gmail.com> Cc: Colin Ian King <colin.king@canonical.com> Cc: Lorenzo Stoakes <lstoakes@gmail.com> Cc: Qiaowei Ren <qiaowei.ren@intel.com> Cc: Arnaldo Carvalho de Melo <acme@redhat.com> Cc: Masami Hiramatsu <mhiramat@kernel.org> Cc: Adrian Hunter <adrian.hunter@intel.com> Cc: Kees Cook <keescook@chromium.org> Cc: Thomas Garnier <thgarnie@google.com> Cc: Peter Zijlstra <peterz@infradead.org> Cc: Borislav Petkov <bp@suse.de> Cc: Dmitry Vyukov <dvyukov@google.com> Cc: Ravi V. Shankar <ravi.v.shankar@intel.com> Cc: x86@kernel.org Signed-off-by: Ricardo Neri <ricardo.neri-calderon@linux.intel.com> --- arch/x86/lib/insn-eval.c | 10 ++++++++++ 1 file changed, 10 insertions(+)
diff --git a/arch/x86/lib/insn-eval.c b/arch/x86/lib/insn-eval.c index c7c1239..9822061 100644 --- a/arch/x86/lib/insn-eval.c +++ b/arch/x86/lib/insn-eval.c @@ -848,6 +848,12 @@ void __user *insn_get_addr_ref(struct insn *insn, struct pt_regs *regs) linear_addr &= 0xffffffff; /* + * Even though 32-bit address encodings are allowed in virtual-8086 + * mode, the address range is still limited to [0x-0xffff]. + */ + if (v8086_mode(regs) && (linear_addr & ~0xffff)) + goto out_err; + /* * Make sure the effective address is within the limits of the * segment. In long mode, the limit is -1L. Thus, the second part * of the check always succeeds. @@ -857,6 +863,10 @@ void __user *insn_get_addr_ref(struct insn *insn, struct pt_regs *regs) linear_addr += seg_base_addr; + /* Limit linear address to 20 bits */ + if (v8086_mode(regs)) + linear_addr &= 0xfffff; + return (void __user *)linear_addr; out_err: return (void __user *)-1; -- 2.9.3
| |