From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753449AbbBSA2w (ORCPT ); Wed, 18 Feb 2015 19:28:52 -0500 Received: from terminus.zytor.com ([198.137.202.10]:47671 "EHLO terminus.zytor.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752478AbbBSA2t (ORCPT ); Wed, 18 Feb 2015 19:28:49 -0500 Date: Wed, 18 Feb 2015 16:28:36 -0800 From: tip-bot for Andy Lutomirski Message-ID: Cc: mingo@kernel.org, linux-kernel@vger.kernel.org, masami.hiramatsu.pt@hitachi.com, hpa@zytor.com, luto@amacapital.net, dave.hansen@linux.intel.com, tglx@linutronix.de Reply-To: dave.hansen@linux.intel.com, tglx@linutronix.de, linux-kernel@vger.kernel.org, mingo@kernel.org, luto@amacapital.net, hpa@zytor.com, masami.hiramatsu.pt@hitachi.com In-Reply-To: References: To: linux-tip-commits@vger.kernel.org Subject: [tip:x86/asm] x86/asm/decoder: Fix and enforce max instruction size in the insn decoder Git-Commit-ID: 91e5ed49fca09c2b83b262b9757d1376ee2b46c3 X-Mailer: tip-git-log-daemon Robot-ID: Robot-Unsubscribe: Contact to get blacklisted from these emails MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Content-Type: text/plain; charset=UTF-8 Content-Disposition: inline Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Commit-ID: 91e5ed49fca09c2b83b262b9757d1376ee2b46c3 Gitweb: http://git.kernel.org/tip/91e5ed49fca09c2b83b262b9757d1376ee2b46c3 Author: Andy Lutomirski AuthorDate: Tue, 27 Jan 2015 16:06:02 -0800 Committer: Ingo Molnar CommitDate: Thu, 19 Feb 2015 00:01:24 +0100 x86/asm/decoder: Fix and enforce max instruction size in the insn decoder x86 instructions cannot exceed 15 bytes, and the instruction decoder should enforce that. Prior to 6ba48ff46f76, the instruction length limit was implicitly set to 16, which was an approximation of 15, but there is currently no limit at all. Fix MAX_INSN_SIZE (it should be 15, not 16), and fix the decoder to reject instructions that exceed MAX_INSN_SIZE. Other than potentially confusing some of the decoder sanity checks, I'm not aware of any actual problems that omitting this check would cause, nor am I aware of any practical problems caused by the MAX_INSN_SIZE error. Signed-off-by: Andy Lutomirski Acked-by: Masami Hiramatsu Cc: Dave Hansen Fixes: 6ba48ff46f76 ("x86: Remove arbitrary instruction size limit ... Link: http://lkml.kernel.org/r/f8f0bc9b8c58cfd6830f7d88400bf1396cbdcd0f.1422403511.git.luto@amacapital.net Signed-off-by: Ingo Molnar --- arch/x86/include/asm/insn.h | 2 +- arch/x86/lib/insn.c | 7 +++++++ 2 files changed, 8 insertions(+), 1 deletion(-) diff --git a/arch/x86/include/asm/insn.h b/arch/x86/include/asm/insn.h index 47f29b1..e7814b7 100644 --- a/arch/x86/include/asm/insn.h +++ b/arch/x86/include/asm/insn.h @@ -69,7 +69,7 @@ struct insn { const insn_byte_t *next_byte; }; -#define MAX_INSN_SIZE 16 +#define MAX_INSN_SIZE 15 #define X86_MODRM_MOD(modrm) (((modrm) & 0xc0) >> 6) #define X86_MODRM_REG(modrm) (((modrm) & 0x38) >> 3) diff --git a/arch/x86/lib/insn.c b/arch/x86/lib/insn.c index 5ea00dd..8f72b33 100644 --- a/arch/x86/lib/insn.c +++ b/arch/x86/lib/insn.c @@ -52,6 +52,13 @@ */ void insn_init(struct insn *insn, const void *kaddr, int buf_len, int x86_64) { + /* + * Instructions longer than MAX_INSN_SIZE (15 bytes) are invalid + * even if the input buffer is long enough to hold them. + */ + if (buf_len > MAX_INSN_SIZE) + buf_len = MAX_INSN_SIZE; + memset(insn, 0, sizeof(*insn)); insn->kaddr = kaddr; insn->end_kaddr = kaddr + buf_len;