lkml.org 
[lkml]   [2020]   [Dec]   [2]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    From
    Subject[PATCH v2 0/3] x86/insn: Fix not using prefixes.nbytes for loop over prefixes.bytes
    Date
    Hi,

    Here are the 2nd version of patches to fix the wrong loop boundary
    check on insn.prefixes.bytes[] array.

    The previous version is here;

    https://lkml.kernel.org/r/160689905099.3084105.7880450206184269465.stgit@devnote2

    In this version, I introduced for_each_insn_prefix() macro to
    for looping on the prefixes in the given instruction and fixed
    out-of-bounds-read issue by checking index first. Also, I sorted
    the patches so that the oldest commit fix becomes the first patch
    because it will go into the older stable kernel and that introduces
    the new iteration macro.

    Kees Cook got a syzbot warning and found this issue and there were
    similar wrong boundary check patterns in the x86 code.

    Since the insn.prefixes.nbytes can be bigger than the size of
    insn.prefixes.bytes[] when a same prefix is repeated, we have to
    check whether the insn.prefixes.bytes[i] != 0 (*) and i < 4 instead
    of insn.prefixes.nbytes.

    (*) Note that insn.prefixes.bytes[] should be zeroed in insn_init()
    before decoding, and 0x00 is not a legacy prefix. So if you see 0
    on insn.prefix.bytes[], it indicates the end of the array. Or,
    if the prefixes.bytes[] is filled with prefix bytes, we can check
    the index is less than 4.

    Thank you,

    ---

    Masami Hiramatsu (3):
    x86/uprobes: Fix not using prefixes.nbytes for loop over prefixes.bytes
    x86/insn-eval: Fix not using prefixes.nbytes for loop over prefixes.bytes
    x86/sev-es: Fix not using prefixes.nbytes for loop over prefixes.bytes


    arch/x86/boot/compressed/sev-es.c | 5 ++---
    arch/x86/include/asm/insn.h | 15 +++++++++++++++
    arch/x86/kernel/uprobes.c | 10 ++++++----
    arch/x86/lib/insn-eval.c | 10 +++++-----
    4 files changed, 28 insertions(+), 12 deletions(-)

    --
    Masami Hiramatsu (Linaro) <mhiramat@kernel.org>

    \
     
     \ /
      Last update: 2020-12-03 05:52    [W:2.345 / U:1.124 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site