From: Masami Hiramatsu <mhiramat@kernel.org>
To: x86@kernel.org, Thomas Gleixner <tglx@linutronix.de>,
Ingo Molnar <mingo@kernel.org>, Borislav Petkov <bp@alien8.de>
Cc: Kees Cook <keescook@chromium.org>,
Masami Hiramatsu <mhiramat@kernel.org>,
"H . Peter Anvin" <hpa@zytor.com>, Joerg Roedel <jroedel@suse.de>,
Tom Lendacky <thomas.lendacky@amd.com>,
"Gustavo A . R . Silva" <gustavoars@kernel.org>,
Jann Horn <jannh@google.com>,
Srikar Dronamraju <srikar@linux.vnet.ibm.com>,
Ricardo Neri <ricardo.neri-calderon@linux.intel.com>,
linux-kernel@vger.kernel.org
Subject: [PATCH v2 0/3] x86/insn: Fix not using prefixes.nbytes for loop over prefixes.bytes
Date: Thu, 3 Dec 2020 13:50:26 +0900 [thread overview]
Message-ID: <160697102582.3146288.10127018634865687932.stgit@devnote2> (raw)
Hi,
Here are the 2nd version of patches to fix the wrong loop boundary
check on insn.prefixes.bytes[] array.
The previous version is here;
https://lkml.kernel.org/r/160689905099.3084105.7880450206184269465.stgit@devnote2
In this version, I introduced for_each_insn_prefix() macro to
for looping on the prefixes in the given instruction and fixed
out-of-bounds-read issue by checking index first. Also, I sorted
the patches so that the oldest commit fix becomes the first patch
because it will go into the older stable kernel and that introduces
the new iteration macro.
Kees Cook got a syzbot warning and found this issue and there were
similar wrong boundary check patterns in the x86 code.
Since the insn.prefixes.nbytes can be bigger than the size of
insn.prefixes.bytes[] when a same prefix is repeated, we have to
check whether the insn.prefixes.bytes[i] != 0 (*) and i < 4 instead
of insn.prefixes.nbytes.
(*) Note that insn.prefixes.bytes[] should be zeroed in insn_init()
before decoding, and 0x00 is not a legacy prefix. So if you see 0
on insn.prefix.bytes[], it indicates the end of the array. Or,
if the prefixes.bytes[] is filled with prefix bytes, we can check
the index is less than 4.
Thank you,
---
Masami Hiramatsu (3):
x86/uprobes: Fix not using prefixes.nbytes for loop over prefixes.bytes
x86/insn-eval: Fix not using prefixes.nbytes for loop over prefixes.bytes
x86/sev-es: Fix not using prefixes.nbytes for loop over prefixes.bytes
arch/x86/boot/compressed/sev-es.c | 5 ++---
arch/x86/include/asm/insn.h | 15 +++++++++++++++
arch/x86/kernel/uprobes.c | 10 ++++++----
arch/x86/lib/insn-eval.c | 10 +++++-----
4 files changed, 28 insertions(+), 12 deletions(-)
--
Masami Hiramatsu (Linaro) <mhiramat@kernel.org>
next reply other threads:[~2020-12-03 4:51 UTC|newest]
Thread overview: 32+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-12-03 4:50 Masami Hiramatsu [this message]
2020-12-03 4:50 ` [PATCH v2 1/3] x86/uprobes: Fix not using prefixes.nbytes for loop over prefixes.bytes Masami Hiramatsu
2020-12-03 12:37 ` Borislav Petkov
2020-12-03 12:41 ` Borislav Petkov
2020-12-03 12:48 ` Borislav Petkov
2020-12-03 16:45 ` Tom Lendacky
2020-12-03 16:54 ` Borislav Petkov
2020-12-03 17:01 ` Borislav Petkov
2020-12-03 18:10 ` Tom Lendacky
2020-12-03 18:17 ` Borislav Petkov
2020-12-03 18:49 ` Tom Lendacky
2020-12-04 0:56 ` Masami Hiramatsu
2020-12-04 3:55 ` Masami Hiramatsu
2020-12-04 11:06 ` Borislav Petkov
2020-12-04 11:28 ` Masami Hiramatsu
2020-12-04 0:16 ` Masami Hiramatsu
2020-12-04 0:18 ` Masami Hiramatsu
2020-12-04 15:04 ` [tip: x86/urgent] x86/uprobes: Do not use prefixes.nbytes when looping " tip-bot2 for Masami Hiramatsu
2020-12-05 0:12 ` Masami Hiramatsu
2020-12-05 10:17 ` Borislav Petkov
2020-12-06 3:53 ` Masami Hiramatsu
2020-12-06 9:02 ` Borislav Petkov
2020-12-09 18:01 ` Arnaldo Carvalho de Melo
2020-12-10 10:36 ` Borislav Petkov
2020-12-09 18:05 ` Arnaldo Carvalho de Melo
2020-12-06 9:09 ` tip-bot2 for Masami Hiramatsu
2020-12-03 4:50 ` [PATCH v2 2/3] x86/insn-eval: Fix not using prefixes.nbytes for loop " Masami Hiramatsu
2020-12-04 15:04 ` [tip: x86/urgent] x86/insn-eval: Use new for_each_insn_prefix() macro to loop over prefixes bytes tip-bot2 for Masami Hiramatsu
2020-12-06 9:09 ` tip-bot2 for Masami Hiramatsu
2020-12-03 4:51 ` [PATCH v2 3/3] x86/sev-es: Fix not using prefixes.nbytes for loop over prefixes.bytes Masami Hiramatsu
2020-12-04 15:04 ` [tip: x86/urgent] x86/sev-es: Use new for_each_insn_prefix() macro to loop over prefixes bytes tip-bot2 for Masami Hiramatsu
2020-12-06 9:09 ` tip-bot2 for Masami Hiramatsu
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=160697102582.3146288.10127018634865687932.stgit@devnote2 \
--to=mhiramat@kernel.org \
--cc=bp@alien8.de \
--cc=gustavoars@kernel.org \
--cc=hpa@zytor.com \
--cc=jannh@google.com \
--cc=jroedel@suse.de \
--cc=keescook@chromium.org \
--cc=linux-kernel@vger.kernel.org \
--cc=mingo@kernel.org \
--cc=ricardo.neri-calderon@linux.intel.com \
--cc=srikar@linux.vnet.ibm.com \
--cc=tglx@linutronix.de \
--cc=thomas.lendacky@amd.com \
--cc=x86@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).