Messages in this thread | | | From | Masami Hiramatsu <> | Subject | [PATCH 0/3] x86/insn: Fix not using prefixes.nbytes for loop over prefixes.bytes | Date | Wed, 2 Dec 2020 17:50:51 +0900 |
| |
Hi,
Here are the patches to fix the wrong loop boundary check on insn.prefixes.bytes[] array.
Kees Cook reported that this issue that there are similar wrong boundary check patterns in the x86 code.
Since the insn.prefixes.nbytes can be bigger than the size of insn.prefixes.bytes[] when a same prefix is repeated, we have to check whether the insn.prefixes.bytes[i] != 0 (*) and i < 4 instead of insn.prefixes.nbytes.
(*) Note that insn.prefixes.bytes[] should be zeroed in insn_init() before decoding, and 0x00 is not a legacy prefix. So if you see 0 on insn.prefix.bytes[], it indicates the end of the array. Or, if the prefixes.bytes[] is filled with prefix bytes, we can check the index is less than 4.
Thank you,
---
Masami Hiramatsu (3): x86/sev-es: Fix not using prefixes.nbytes for loop over prefixes.bytes x86/uprobes: Fix not using prefixes.nbytes for loop over prefixes.bytes x86/insn-eval: Fix not using prefixes.nbytes for loop over prefixes.bytes
arch/x86/boot/compressed/sev-es.c | 2 +- arch/x86/kernel/uprobes.c | 4 ++-- arch/x86/lib/insn-eval.c | 4 ++-- 3 files changed, 5 insertions(+), 5 deletions(-)
-- Masami Hiramatsu (Linaro) <mhiramat@kernel.org>
| |