x86/mpx: Fix instruction decoder condition

MPX decodes instructions in order to tell which bounds register was violated. Part of this decoding involves looking at the "REX prefix" which is a special instrucion prefix used to retrofit support for new registers in to old instructions. The X86_REX_*() macros are defined to return actual bit values: #define X86_REX_R(rex) ((rex) & 4) *not* boolean values. However, the MPX code was checking for them like they were booleans. This might have led to us mis-decoding the "REX prefix" and giving false information out to userspace about bounds violations. X86_REX_B() actually is bit 1, so this is really only broken for the X86_REX_X() case. Fix the conditionals up to tolerate the non-boolean values.

Dave Hansen committed 10 years ago

Commit 8e8efe01 parent 70f15281 file · +3 −3Browse files

Unified · Split

arch/x86/mm/mpx.c+3−3

@@ -101,19 +101,19 @@ static int get_reg_offset(struct insn insn, struct pt_regs regs, · 100 unmodified lines
101	101	switch (type) {
102	102	case REG_TYPE_RM:
103	103	regno = X86_MODRM_RM(insn->modrm.value);
104		− if (X86_REX_B(insn->rex_prefix.value) == 1)
	104	+ if (X86_REX_B(insn->rex_prefix.value))
105	105	regno += 8;
106	106	break;
107	107
108	108	case REG_TYPE_INDEX:
109	109	regno = X86_SIB_INDEX(insn->sib.value);
110		− if (X86_REX_X(insn->rex_prefix.value) == 1)
	110	+ if (X86_REX_X(insn->rex_prefix.value))
111	111	regno += 8;
112	112	break;
113	113
114	114	case REG_TYPE_BASE:
115	115	regno = X86_SIB_BASE(insn->sib.value);
116		− if (X86_REX_B(insn->rex_prefix.value) == 1)
	116	+ if (X86_REX_B(insn->rex_prefix.value))
117	117	regno += 8;
118	118	break;
119	119