Messages in this thread | | | Date | Mon, 15 Aug 2022 09:29:20 +0200 | From | Peter Zijlstra <> | Subject | Re: [PATCH] x86/kprobes: fix JNG/JNLE emulation |
| |
On Sat, Aug 13, 2022 at 03:59:43PM -0700, Nadav Amit wrote: > From: Nadav Amit <namit@vmware.com> > > When kprobes emulates JNG/JNLE instructions on x86 it uses the wrong > condition. For JNG (opcode: 0F 8E), according to Intel SDM, the jump is > performed if (ZF == 1 or SF != OF). However the kernel emulation > currently uses 'and' instead of 'or'. > > As a result, setting a kprobe on JNG/JNLE might cause the kernel to > behave incorrectly whenever the kprobe is hit. > > Fix by changing the 'and' to 'or'. > > Cc: Masami Hiramatsu <mhiramat@kernel.org> > Cc: Peter Zijlstra (Intel) <peterz@infradead.org> > Cc: Andy Lutomirski <luto@kernel.org> > Cc: stable@vger.kernel.org > Fixes: 6256e668b7af ("x86/kprobes: Use int3 instead of debug trap for single-step") > Signed-off-by: Nadav Amit <namit@vmware.com>
Urgghh..
Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org>
> --- > arch/x86/kernel/kprobes/core.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/arch/x86/kernel/kprobes/core.c b/arch/x86/kernel/kprobes/core.c > index 74167dc5f55e..4c3c27b6aea3 100644 > --- a/arch/x86/kernel/kprobes/core.c > +++ b/arch/x86/kernel/kprobes/core.c > @@ -505,7 +505,7 @@ static void kprobe_emulate_jcc(struct kprobe *p, struct pt_regs *regs) > match = ((regs->flags & X86_EFLAGS_SF) >> X86_EFLAGS_SF_BIT) ^ > ((regs->flags & X86_EFLAGS_OF) >> X86_EFLAGS_OF_BIT); > if (p->ainsn.jcc.type >= 0xe) > - match = match && (regs->flags & X86_EFLAGS_ZF); > + match = match || (regs->flags & X86_EFLAGS_ZF); > } > __kprobe_emulate_jmp(p, regs, (match && !invert) || (!match && invert)); > } > -- > 2.25.1 >
| |