From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 13AD5320CBE; Mon, 27 Oct 2025 18:55:51 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1761591351; cv=none; b=tSQ5ePWGRo/Fkf7P25CFcCSC8tFYR4O0HlpAIpkDdVixr8BjMwKOJ/9CPUR0avkRpAOGKur4IfqAELmZEebLVQwk5JFJ87YiXgt6qpVTB2zDhdRUltUstQAsiQMRiTqCkx0DJ2NUBPAW6ZL9tqJAJr3nJBkuAEXckvdpnzFojvI= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1761591351; c=relaxed/simple; bh=mjfnZcMbTeMXj+7WRDQ+h+w9fC6XEo16/+66PTjN1sc=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=K3E2CnLOUc3xD93u+k67kYfGkLBIr4PAV9164heJLwiuw+cGE4mGq/JD1SwLh24VsJfr+oaASZ1uGAy1sNoVEJT3Ky7tkhAei9Te3AOTN7PJnSzZu+0XShbiM7Y0hIHgk/t0u4338Ead74RWsBC/JPwn28M1VsTghkw/RUjxpP8= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=G5ZDfASg; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="G5ZDfASg" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 9B612C4CEF1; Mon, 27 Oct 2025 18:55:50 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1761591351; bh=mjfnZcMbTeMXj+7WRDQ+h+w9fC6XEo16/+66PTjN1sc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=G5ZDfASgoR/W+Wf6/bf6zrxeWJ0g68UmX86iPpZ+OrfbOBM1VxVmaGgE7s6smSrmH zRat0YX5yeWsDKo36z3BifTSJx8F1lxDY69w26La0S3g0jptvxgO4MnBhOPk5l6jlV zmxAp66YdeeVGH6SJTkJvBEGwO1FNkwRmeNOpcWU= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Dan Snyder , Sean Christopherson , "Borislav Petkov (AMD)" , "Peter Zijlstra (Intel)" Subject: [PATCH 5.10 164/332] x86/umip: Check that the instruction opcode is at least two bytes Date: Mon, 27 Oct 2025 19:33:37 +0100 Message-ID: <20251027183528.956544614@linuxfoundation.org> X-Mailer: git-send-email 2.51.1 In-Reply-To: <20251027183524.611456697@linuxfoundation.org> References: <20251027183524.611456697@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: patches@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 5.10-stable review patch. If anyone has any objections, please let me know. ------------------ From: Sean Christopherson commit 32278c677947ae2f042c9535674a7fff9a245dd3 upstream. When checking for a potential UMIP violation on #GP, verify the decoder found at least two opcode bytes to avoid false positives when the kernel encounters an unknown instruction that starts with 0f. Because the array of opcode.bytes is zero-initialized by insn_init(), peeking at bytes[1] will misinterpret garbage as a potential SLDT or STR instruction, and can incorrectly trigger emulation. E.g. if a VPALIGNR instruction 62 83 c5 05 0f 08 ff vpalignr xmm17{k5},xmm23,XMMWORD PTR [r8],0xff hits a #GP, the kernel emulates it as STR and squashes the #GP (and corrupts the userspace code stream). Arguably the check should look for exactly two bytes, but no three byte opcodes use '0f 00 xx' or '0f 01 xx' as an escape, i.e. it should be impossible to get a false positive if the first two opcode bytes match '0f 00' or '0f 01'. Go with a more conservative check with respect to the existing code to minimize the chances of breaking userspace, e.g. due to decoder weirdness. Analyzed by Nick Bray . Fixes: 1e5db223696a ("x86/umip: Add emulation code for UMIP instructions") Reported-by: Dan Snyder Signed-off-by: Sean Christopherson Signed-off-by: Borislav Petkov (AMD) Acked-by: Peter Zijlstra (Intel) Cc: stable@vger.kernel.org Signed-off-by: Greg Kroah-Hartman --- arch/x86/kernel/umip.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) --- a/arch/x86/kernel/umip.c +++ b/arch/x86/kernel/umip.c @@ -156,8 +156,8 @@ static int identify_insn(struct insn *in if (!insn->modrm.nbytes) return -EINVAL; - /* All the instructions of interest start with 0x0f. */ - if (insn->opcode.bytes[0] != 0xf) + /* The instructions of interest have 2-byte opcodes: 0F 00 or 0F 01. */ + if (insn->opcode.nbytes < 2 || insn->opcode.bytes[0] != 0xf) return -EINVAL; if (insn->opcode.bytes[1] == 0x1) {