From: Colin Ian King <colin.king@canonical.com>
To: Masami Hiramatsu <mhiramat@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>,
Andy Lutomirski <luto@kernel.org>,
Thomas Gleixner <tglx@linutronix.de>,
Borislav Petkov <bp@alien8.de>,
"linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>
Subject: re: x86/kprobes: Use int3 instead of debug trap for single-step
Date: Wed, 24 Mar 2021 15:48:34 +0000 [thread overview]
Message-ID: <37cd1689-d192-dd89-af7c-eaf074b5f911@canonical.com> (raw)
Hi,
Static analysis on linux-next using Coverity has detected an issue in
the following commit:
commit 6256e668b7af9d81472e03c6a171630c08f8858a
Author: Masami Hiramatsu <mhiramat@kernel.org>
Date: Wed Mar 3 00:25:46 2021 +0900
x86/kprobes: Use int3 instead of debug trap for single-step
The analysis is as follows:
160 switch (opcode & 0xf0) {
161 case 0x60:
162 /* can't boost "bound" */
163 return (opcode != 0x62);
164 case 0x70:
165 return 0; /* can't boost conditional jump */
166 case 0x90:
167 return opcode != 0x9a; /* can't boost call far */
168 case 0xc0:
169 /* can't boost software-interruptions */
170 return (0xc1 < opcode && opcode < 0xcc) || opcode ==
0xcf;
171 case 0xd0:
172 /* can boost AA* and XLAT */
173 return (opcode == 0xd4 || opcode == 0xd5 || opcode ==
0xd7);
174 case 0xe0:
175 /* can boost in/out and absolute jmps */
176 return ((opcode & 0x04) || opcode == 0xea);
177 case 0xf0:
178 /* clear and set flags are boostable */
179 return (opcode == 0xf5 || (0xf7 < opcode && opcode <
0xfe));
dead_error_condition: The switch governing value opcode & 0xf0 cannot
be 255.
undefined (#1 of 1): Logically dead code (DEADCODE)
dead_error_begin: Execution cannot reach this statement: case 255:
180 case 0xff:
181 /* indirect jmp is boostable */
182 return X86_MODRM_REG(insn->modrm.bytes[0]) == 4;
the case 0xff statement can never be reached because the switch
statement is acting on opcode & 0xf0.
Colin
next reply other threads:[~2021-03-24 15:49 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-03-24 15:48 Colin Ian King [this message]
2021-03-24 22:58 ` x86/kprobes: Use int3 instead of debug trap for single-step Masami Hiramatsu
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=37cd1689-d192-dd89-af7c-eaf074b5f911@canonical.com \
--to=colin.king@canonical.com \
--cc=bp@alien8.de \
--cc=linux-kernel@vger.kernel.org \
--cc=luto@kernel.org \
--cc=mhiramat@kernel.org \
--cc=peterz@infradead.org \
--cc=tglx@linutronix.de \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).