Hi, Here are the 3rd version of patches to fix the wrong loop boundary check on insn.prefixes.bytes[] array.
The previous version is here; https://lkml.kernel.org/r/160697102582.3146288.10127018634865687932.stgit@devnote2 In this version, I've fixed some comments, added NUM_INSN_FIELD_BYTES and MAX_LEGACY_PREFIX_GROUPS macros and commented on it. Kees Cook got a syzbot warning and found this issue and there were similar wrong boundary check patterns in the x86 code. Since the insn.prefixes.nbytes can be bigger than the size of insn.prefixes.bytes[] when a same prefix is repeated, we have to check whether the insn.prefixes.bytes[i] != 0 (*) and i < 4 instead of insn.prefixes.nbytes. (*) Note that insn.prefixes.bytes[] should be zeroed in insn_init() before decoding, and 0x00 is not a legacy prefix. So if you see 0 on insn.prefix.bytes[], it indicates the end of the array. Or, if the prefixes.bytes[] is filled with prefix bytes, we can check the index is less than 4. Thank you, --- Masami Hiramatsu (3): x86/uprobes: Fix not using prefixes.nbytes for loop over prefixes.bytes x86/insn-eval: Fix not using prefixes.nbytes for loop over prefixes.bytes x86/sev-es: Fix not using prefixes.nbytes for loop over prefixes.bytes arch/x86/boot/compressed/sev-es.c | 5 ++-- arch/x86/include/asm/insn.h | 49 ++++++++++++++++++++++++++++++++++++- arch/x86/kernel/uprobes.c | 10 +++++--- arch/x86/lib/insn-eval.c | 10 ++++---- arch/x86/lib/insn.c | 2 +- tools/arch/x86/include/asm/insn.h | 49 ++++++++++++++++++++++++++++++++++++- tools/arch/x86/lib/insn.c | 2 +- 7 files changed, 111 insertions(+), 16 deletions(-) -- Masami Hiramatsu (Linaro) <mhira...@kernel.org>
