lkml.org 
[lkml]   [2020]   [Dec]   [2]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
Subject[PATCH 0/3] x86/insn: Fix not using prefixes.nbytes for loop over prefixes.bytes
Date
Hi,

Here are the patches to fix the wrong loop boundary check
on insn.prefixes.bytes[] array.

Kees Cook reported that this issue that there are similar
wrong boundary check patterns in the x86 code.

Since the insn.prefixes.nbytes can be bigger than the size of
insn.prefixes.bytes[] when a same prefix is repeated, we have to
check whether the insn.prefixes.bytes[i] != 0 (*) and i < 4 instead
of insn.prefixes.nbytes.

(*) Note that insn.prefixes.bytes[] should be zeroed in insn_init()
before decoding, and 0x00 is not a legacy prefix. So if you see 0
on insn.prefix.bytes[], it indicates the end of the array. Or,
if the prefixes.bytes[] is filled with prefix bytes, we can check
the index is less than 4.

Thank you,

---

Masami Hiramatsu (3):
x86/sev-es: Fix not using prefixes.nbytes for loop over prefixes.bytes
x86/uprobes: Fix not using prefixes.nbytes for loop over prefixes.bytes
x86/insn-eval: Fix not using prefixes.nbytes for loop over prefixes.bytes


arch/x86/boot/compressed/sev-es.c | 2 +-
arch/x86/kernel/uprobes.c | 4 ++--
arch/x86/lib/insn-eval.c | 4 ++--
3 files changed, 5 insertions(+), 5 deletions(-)

--
Masami Hiramatsu (Linaro) <mhiramat@kernel.org>

\
 
 \ /
  Last update: 2020-12-02 09:53    [W:0.074 / U:0.400 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site