[v3 PATCH 02/10] x86/mpx: Fail decoding when SIB baseR/EBP is and no displacement is used

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Section 2.2.1.2 of the Intel 64 and IA-32 Architectures Software
Developer's Manual volume 2A states that when a SIB byte is used and the
base of such SIB byte points to R/EBP (i.e., base = 5), an explicit
displacement is needed. This is, the mod part of the ModRM byte cannot be
zero. In case that no displacement is needed, the mod part of the ModRM
byte must be 1 with the displacement byte equal to zero.

Make the address decoder to return -EINVAL in the aforementioned case.

Cc: Dave Hansen <dave.hansen@xxxxxxxxxxxxxxx>
Cc: Adam Buchbinder <adam.buchbinder@xxxxxxxxx>
Cc: Colin Ian King <colin.king@xxxxxxxxxxxxx>
Cc: Lorenzo Stoakes <lstoakes@xxxxxxxxx>
Cc: Qiaowei Ren <qiaowei.ren@xxxxxxxxx>
Cc: Ravi V. Shankar <ravi.v.shankar@xxxxxxxxx>
Cc: x86@xxxxxxxxxx
Signed-off-by: Ricardo Neri <ricardo.neri-calderon@xxxxxxxxxxxxxxx>
---
 arch/x86/mm/mpx.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/arch/x86/mm/mpx.c b/arch/x86/mm/mpx.c
index 9d15f6b..c59a851 100644
--- a/arch/x86/mm/mpx.c
+++ b/arch/x86/mm/mpx.c
@@ -120,6 +120,14 @@ static int get_reg_offset(struct insn *insn, struct pt_regs *regs,
 
 	case REG_TYPE_BASE:
 		regno = X86_SIB_BASE(insn->sib.value);
+		/*
+		 * If R/EBP (regno = 5) is indicated in the base part of the SIB
+		 * byte, an explicit displacement must be specified. In other
+		 * words, the mod part of the ModRM byte cannot be zero.
+		 */
+		if (regno == 5 && X86_MODRM_MOD(insn->modrm.value) == 0)
+			return -EINVAL;
+
 		if (X86_REX_B(insn->rex_prefix.value))
 			regno += 8;
 		break;
-- 
2.9.3

--
To unsubscribe from this list: send the line "unsubscribe linux-msdos" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html



[Index of Archives]     [Linux Console]     [Linux Audio]     [Linux for Hams]     [Kernel Newbies]     [Security]     [Netfilter]     [Bugtraq]     [Yosemite Camping]     [Yosemite Hiking]     [MIPS Linux]     [ARM Linux]     [Linux RAID]     [Samba]     [Linux Media]     [Fedora Users]

  Powered by Linux