From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id E306BC00140 for ; Mon, 15 Aug 2022 07:29:48 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230242AbiHOH3r (ORCPT ); Mon, 15 Aug 2022 03:29:47 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:60024 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229647AbiHOH3l (ORCPT ); Mon, 15 Aug 2022 03:29:41 -0400 Received: from casper.infradead.org (casper.infradead.org [IPv6:2001:8b0:10b:1236::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 7C8C51834D; Mon, 15 Aug 2022 00:29:40 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=infradead.org; s=casper.20170209; h=In-Reply-To:Content-Type:MIME-Version: References:Message-ID:Subject:Cc:To:From:Date:Sender:Reply-To: Content-Transfer-Encoding:Content-ID:Content-Description; bh=WLetqZztJRGpEs+QGrVdxJPRivEZitIYqQS4z+3w0us=; b=Z1LAkm9Z/Jk1kEPqfMnOx2pfGs AnaD2SHDCwOs0LXfFbNIFQrNP2QO02HSNSWUIqBeUevxDPjX0ygn/rbmIi86BZWpaYoq5jLyLRt7m Nm6vombiB3LD1gMSc+w+AWOtOKWAIljTD2uDfOXWakmdC5EpWeDRa6TFjtLUsVvRaul5x8X+gqsUP V8yvn0ln24bpfiHr2fRGGkl6JkvDjlaK4eyr14cB1EHHpMg+Xg/HvrMpRK7svhXehIRiLVmkPXgCL ZjQdKAHVoe+b1HJflXz0EL4Px9xAnn0zlhe2kFk9JG/l8NEBGC1jszeB9hs4hnTbBKkCL1b8adgql LgYQqHDw==; Received: from j130084.upc-j.chello.nl ([24.132.130.84] helo=worktop.programming.kicks-ass.net) by casper.infradead.org with esmtpsa (Exim 4.94.2 #2 (Red Hat Linux)) id 1oNUXK-005WG8-Jj; Mon, 15 Aug 2022 07:29:22 +0000 Received: by worktop.programming.kicks-ass.net (Postfix, from userid 1000) id D4BC4980264; Mon, 15 Aug 2022 09:29:20 +0200 (CEST) Date: Mon, 15 Aug 2022 09:29:20 +0200 From: Peter Zijlstra To: Nadav Amit Cc: Thomas Gleixner , Ingo Molnar , Borislav Petkov , Dave Hansen , x86@kernel.org, linux-kernel@vger.kernel.org, Nadav Amit , Masami Hiramatsu , Andy Lutomirski , stable@vger.kernel.org Subject: Re: [PATCH] x86/kprobes: fix JNG/JNLE emulation Message-ID: References: <20220813225943.143767-1-namit@vmware.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20220813225943.143767-1-namit@vmware.com> Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Sat, Aug 13, 2022 at 03:59:43PM -0700, Nadav Amit wrote: > From: Nadav Amit > > When kprobes emulates JNG/JNLE instructions on x86 it uses the wrong > condition. For JNG (opcode: 0F 8E), according to Intel SDM, the jump is > performed if (ZF == 1 or SF != OF). However the kernel emulation > currently uses 'and' instead of 'or'. > > As a result, setting a kprobe on JNG/JNLE might cause the kernel to > behave incorrectly whenever the kprobe is hit. > > Fix by changing the 'and' to 'or'. > > Cc: Masami Hiramatsu > Cc: Peter Zijlstra (Intel) > Cc: Andy Lutomirski > Cc: stable@vger.kernel.org > Fixes: 6256e668b7af ("x86/kprobes: Use int3 instead of debug trap for single-step") > Signed-off-by: Nadav Amit Urgghh.. Acked-by: Peter Zijlstra (Intel) > --- > arch/x86/kernel/kprobes/core.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/arch/x86/kernel/kprobes/core.c b/arch/x86/kernel/kprobes/core.c > index 74167dc5f55e..4c3c27b6aea3 100644 > --- a/arch/x86/kernel/kprobes/core.c > +++ b/arch/x86/kernel/kprobes/core.c > @@ -505,7 +505,7 @@ static void kprobe_emulate_jcc(struct kprobe *p, struct pt_regs *regs) > match = ((regs->flags & X86_EFLAGS_SF) >> X86_EFLAGS_SF_BIT) ^ > ((regs->flags & X86_EFLAGS_OF) >> X86_EFLAGS_OF_BIT); > if (p->ainsn.jcc.type >= 0xe) > - match = match && (regs->flags & X86_EFLAGS_ZF); > + match = match || (regs->flags & X86_EFLAGS_ZF); > } > __kprobe_emulate_jmp(p, regs, (match && !invert) || (!match && invert)); > } > -- > 2.25.1 >