Messages in this thread | | | From | Masami Hiramatsu <> | Subject | [PATCH v2 0/3] x86/insn: Fix not using prefixes.nbytes for loop over prefixes.bytes | Date | Thu, 3 Dec 2020 13:50:26 +0900 |
| |
Hi,
Here are the 2nd version of patches to fix the wrong loop boundary check on insn.prefixes.bytes[] array.
The previous version is here;
https://lkml.kernel.org/r/160689905099.3084105.7880450206184269465.stgit@devnote2
In this version, I introduced for_each_insn_prefix() macro to for looping on the prefixes in the given instruction and fixed out-of-bounds-read issue by checking index first. Also, I sorted the patches so that the oldest commit fix becomes the first patch because it will go into the older stable kernel and that introduces the new iteration macro.
Kees Cook got a syzbot warning and found this issue and there were similar wrong boundary check patterns in the x86 code.
Since the insn.prefixes.nbytes can be bigger than the size of insn.prefixes.bytes[] when a same prefix is repeated, we have to check whether the insn.prefixes.bytes[i] != 0 (*) and i < 4 instead of insn.prefixes.nbytes.
(*) Note that insn.prefixes.bytes[] should be zeroed in insn_init() before decoding, and 0x00 is not a legacy prefix. So if you see 0 on insn.prefix.bytes[], it indicates the end of the array. Or, if the prefixes.bytes[] is filled with prefix bytes, we can check the index is less than 4.
Thank you,
---
Masami Hiramatsu (3): x86/uprobes: Fix not using prefixes.nbytes for loop over prefixes.bytes x86/insn-eval: Fix not using prefixes.nbytes for loop over prefixes.bytes x86/sev-es: Fix not using prefixes.nbytes for loop over prefixes.bytes
arch/x86/boot/compressed/sev-es.c | 5 ++--- arch/x86/include/asm/insn.h | 15 +++++++++++++++ arch/x86/kernel/uprobes.c | 10 ++++++---- arch/x86/lib/insn-eval.c | 10 +++++----- 4 files changed, 28 insertions(+), 12 deletions(-)
-- Masami Hiramatsu (Linaro) <mhiramat@kernel.org>
| |