lkml.org 
[lkml]   [2020]   [Oct]   [15]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Date
    Subject[PATCH v2] x86/insn, tools/x86: Fix some potential undefined behavior.
    From
    From: Numfor Mbiziwo-Tiapo <nums@google.com>

    Don't perform unaligned loads in __get_next and __peek_nbyte_next as
    these are forms of undefined behavior.

    These problems were identified using the undefined behavior sanitizer
    (ubsan) with the tools version of the code and perf test. Part of this
    patch was previously posted here:
    https://lore.kernel.org/lkml/20190724184512.162887-4-nums@google.com/

    v2. removes the validate_next check and merges the 2 changes into one as
    requested by Masami Hiramatsu <mhiramat@kernel.org>

    Signed-off-by: Ian Rogers <irogers@google.com>
    Signed-off-by: Numfor Mbiziwo-Tiapo <nums@google.com>
    ---
    arch/x86/lib/insn.c | 4 ++--
    tools/arch/x86/lib/insn.c | 4 ++--
    2 files changed, 4 insertions(+), 4 deletions(-)

    diff --git a/arch/x86/lib/insn.c b/arch/x86/lib/insn.c
    index 404279563891..be88ab250146 100644
    --- a/arch/x86/lib/insn.c
    +++ b/arch/x86/lib/insn.c
    @@ -20,10 +20,10 @@
    ((insn)->next_byte + sizeof(t) + n <= (insn)->end_kaddr)

    #define __get_next(t, insn) \
    - ({ t r = *(t*)insn->next_byte; insn->next_byte += sizeof(t); r; })
    + ({ t r; memcpy(&r, insn->next_byte, sizeof(t)); insn->next_byte += sizeof(t); r; })

    #define __peek_nbyte_next(t, insn, n) \
    - ({ t r = *(t*)((insn)->next_byte + n); r; })
    + ({ t r; memcpy(&r, (insn)->next_byte + n, sizeof(t)); r; })

    #define get_next(t, insn) \
    ({ if (unlikely(!validate_next(t, insn, 0))) goto err_out; __get_next(t, insn); })
    diff --git a/tools/arch/x86/lib/insn.c b/tools/arch/x86/lib/insn.c
    index 0151dfc6da61..92358c71a59e 100644
    --- a/tools/arch/x86/lib/insn.c
    +++ b/tools/arch/x86/lib/insn.c
    @@ -20,10 +20,10 @@
    ((insn)->next_byte + sizeof(t) + n <= (insn)->end_kaddr)

    #define __get_next(t, insn) \
    - ({ t r = *(t*)insn->next_byte; insn->next_byte += sizeof(t); r; })
    + ({ t r; memcpy(&r, insn->next_byte, sizeof(t)); insn->next_byte += sizeof(t); r; })

    #define __peek_nbyte_next(t, insn, n) \
    - ({ t r = *(t*)((insn)->next_byte + n); r; })
    + ({ t r; memcpy(&r, (insn)->next_byte + n, sizeof(t)); r; })

    #define get_next(t, insn) \
    ({ if (unlikely(!validate_next(t, insn, 0))) goto err_out; __get_next(t, insn); })
    --
    2.28.0.1011.ga647a8990f-goog
    \
     
     \ /
      Last update: 2020-10-15 18:12    [W:2.898 / U:0.552 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site