From mboxrd@z Thu Jan 1 00:00:00 1970 From: Ricardo Neri Subject: [v3 PATCH 02/10] x86/mpx: Fail decoding when SIB baseR/EBP is and no displacement is used Date: Wed, 25 Jan 2017 12:23:45 -0800 Message-ID: <20170125202353.101059-3-ricardo.neri-calderon@linux.intel.com> References: <20170125202353.101059-1-ricardo.neri-calderon@linux.intel.com> Return-path: In-Reply-To: <20170125202353.101059-1-ricardo.neri-calderon@linux.intel.com> Sender: linux-msdos-owner@vger.kernel.org List-ID: MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit To: Ingo Molnar , Thomas Gleixner , "H. Peter Anvin" , Andy Lutomirski , Borislav Petkov Cc: Peter Zijlstra , Andrew Morton , Brian Gerst , Chris Metcalf , Dave Hansen , Paolo Bonzini , Liang Z Li , Masami Hiramatsu , Huang Rui , Jiri Slaby , Jonathan Corbet , "Michael S. Tsirkin" , Paul Gortmaker , Vlastimil Babka , Chen Yucong , Alexandre Julliard , Fenghua Yu , Stas Sergeev , "Ravi V. Shankar" , Shuah Khan , linux-kernel@vger.kern Section 2.2.1.2 of the Intel 64 and IA-32 Architectures Software Developer's Manual volume 2A states that when a SIB byte is used and the base of such SIB byte points to R/EBP (i.e., base = 5), an explicit displacement is needed. This is, the mod part of the ModRM byte cannot be zero. In case that no displacement is needed, the mod part of the ModRM byte must be 1 with the displacement byte equal to zero. Make the address decoder to return -EINVAL in the aforementioned case. Cc: Dave Hansen Cc: Adam Buchbinder Cc: Colin Ian King Cc: Lorenzo Stoakes Cc: Qiaowei Ren Cc: Ravi V. Shankar Cc: x86@kernel.org Signed-off-by: Ricardo Neri --- arch/x86/mm/mpx.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/arch/x86/mm/mpx.c b/arch/x86/mm/mpx.c index 9d15f6b..c59a851 100644 --- a/arch/x86/mm/mpx.c +++ b/arch/x86/mm/mpx.c @@ -120,6 +120,14 @@ static int get_reg_offset(struct insn *insn, struct pt_regs *regs, case REG_TYPE_BASE: regno = X86_SIB_BASE(insn->sib.value); + /* + * If R/EBP (regno = 5) is indicated in the base part of the SIB + * byte, an explicit displacement must be specified. In other + * words, the mod part of the ModRM byte cannot be zero. + */ + if (regno == 5 && X86_MODRM_MOD(insn->modrm.value) == 0) + return -EINVAL; + if (X86_REX_B(insn->rex_prefix.value)) regno += 8; break; -- 2.9.3