From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755251AbbLAAbQ (ORCPT ); Mon, 30 Nov 2015 19:31:16 -0500 Received: from mga02.intel.com ([134.134.136.20]:46843 "EHLO mga02.intel.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751816AbbLAAbO (ORCPT ); Mon, 30 Nov 2015 19:31:14 -0500 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.20,366,1444719600"; d="scan'208";a="697455548" Subject: [PATCH] x86, mpx: fix instruction decoder condition To: linux-kernel@vger.kernel.org Cc: Dave Hansen , dave.hansen@linux.intel.com, dan.carpenter@oracle.com, stable@vger.kernel.org, x86@kernel.org From: Dave Hansen Date: Mon, 30 Nov 2015 16:31:13 -0800 Message-Id: <20151201003113.D800C1E0@viggo.jf.intel.com> Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Dave Hansen MPX decodes instructions in order to tell which bounds register was violated. Part of this decoding involves looking at the "REX prefix" which is a special instrucion prefix used to retrofit support for new registers in to old instructions. The X86_REX_*() macros are defined to return actual bit values: #define X86_REX_R(rex) ((rex) & 4) *not* boolean values. However, the MPX code was checking for them like they were booleans. This might have led to us mis-decoding the "REX prefix" and giving false information out to userspace about bounds violations. X86_REX_B() actually is bit 1, so this is really only broken for the X86_REX_X() case. Fix the conditionals up to tolerate the non-boolean values. Signed-off-by: Dave Hansen Reported-by: Dan Carpenter Cc: stable@vger.kernel.org Cc: x86@kernel.org --- b/arch/x86/mm/mpx.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff -puN arch/x86/mm/mpx.c~mpx-rex arch/x86/mm/mpx.c --- a/arch/x86/mm/mpx.c~mpx-rex 2015-11-30 15:33:32.393469377 -0800 +++ b/arch/x86/mm/mpx.c 2015-11-30 16:12:14.805379908 -0800 @@ -101,19 +101,19 @@ static int get_reg_offset(struct insn *i switch (type) { case REG_TYPE_RM: regno = X86_MODRM_RM(insn->modrm.value); - if (X86_REX_B(insn->rex_prefix.value) == 1) + if (X86_REX_B(insn->rex_prefix.value)) regno += 8; break; case REG_TYPE_INDEX: regno = X86_SIB_INDEX(insn->sib.value); - if (X86_REX_X(insn->rex_prefix.value) == 1) + if (X86_REX_X(insn->rex_prefix.value)) regno += 8; break; case REG_TYPE_BASE: regno = X86_SIB_BASE(insn->sib.value); - if (X86_REX_B(insn->rex_prefix.value) == 1) + if (X86_REX_B(insn->rex_prefix.value)) regno += 8; break; _