lkml.org 
[lkml]   [2022]   [Jan]   [31]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.16 061/200] arm64: extable: fix load_unaligned_zeropad() reg indices
    Date
    From: Evgenii Stepanov <eugenis@google.com>

    commit 3758a6c74e08bdc15ccccd6872a6ad37d165239a upstream.

    In ex_handler_load_unaligned_zeropad() we erroneously extract the data and
    addr register indices from ex->type rather than ex->data. As ex->type will
    contain EX_TYPE_LOAD_UNALIGNED_ZEROPAD (i.e. 4):
    * We'll always treat X0 as the address register, since EX_DATA_REG_ADDR is
    extracted from bits [9:5]. Thus, we may attempt to dereference an
    arbitrary address as X0 may hold an arbitrary value.
    * We'll always treat X4 as the data register, since EX_DATA_REG_DATA is
    extracted from bits [4:0]. Thus we will corrupt X4 and cause arbitrary
    behaviour within load_unaligned_zeropad() and its caller.

    Fix this by extracting both values from ex->data as originally intended.

    On an MTE-enabled QEMU image we are hitting the following crash:
    Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000
    Call trace:
    fixup_exception+0xc4/0x108
    __do_kernel_fault+0x3c/0x268
    do_tag_check_fault+0x3c/0x104
    do_mem_abort+0x44/0xf4
    el1_abort+0x40/0x64
    el1h_64_sync_handler+0x60/0xa0
    el1h_64_sync+0x7c/0x80
    link_path_walk+0x150/0x344
    path_openat+0xa0/0x7dc
    do_filp_open+0xb8/0x168
    do_sys_openat2+0x88/0x17c
    __arm64_sys_openat+0x74/0xa0
    invoke_syscall+0x48/0x148
    el0_svc_common+0xb8/0xf8
    do_el0_svc+0x28/0x88
    el0_svc+0x24/0x84
    el0t_64_sync_handler+0x88/0xec
    el0t_64_sync+0x1b4/0x1b8
    Code: f8695a69 71007d1f 540000e0 927df12a (f940014a)

    Fixes: 753b32368705 ("arm64: extable: add load_unaligned_zeropad() handler")
    Cc: <stable@vger.kernel.org> # 5.16.x
    Reviewed-by: Mark Rutland <mark.rutland@arm.com>
    Signed-off-by: Evgenii Stepanov <eugenis@google.com>
    Link: https://lore.kernel.org/r/20220125182217.2605202-1-eugenis@google.com
    Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    arch/arm64/mm/extable.c | 4 ++--
    1 file changed, 2 insertions(+), 2 deletions(-)

    --- a/arch/arm64/mm/extable.c
    +++ b/arch/arm64/mm/extable.c
    @@ -43,8 +43,8 @@ static bool
    ex_handler_load_unaligned_zeropad(const struct exception_table_entry *ex,
    struct pt_regs *regs)
    {
    - int reg_data = FIELD_GET(EX_DATA_REG_DATA, ex->type);
    - int reg_addr = FIELD_GET(EX_DATA_REG_ADDR, ex->type);
    + int reg_data = FIELD_GET(EX_DATA_REG_DATA, ex->data);
    + int reg_addr = FIELD_GET(EX_DATA_REG_ADDR, ex->data);
    unsigned long data, addr, offset;

    addr = pt_regs_read_reg(regs, reg_addr);

    \
     
     \ /
      Last update: 2022-01-31 12:40    [W:4.089 / U:0.588 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site