x86/mpx: Fix instruction decoder condition

MPX decodes instructions in order to tell which bounds register was violated. Part of this decoding involves looking at the "REX prefix" which is a special instrucion prefix used to retrofit support for new registers in to old instructions. The X86_REX_*() macros are defined to return actual bit values: #define X86_REX_R(rex) ((rex) & 4) *not* boolean values. However, the MPX code was checking for them like they were booleans. This might have led to us mis-decoding the "REX prefix" and giving false information out to userspace about bounds violations. X86_REX_B() actually is bit 1, so this is really only broken for the X86_REX_X() case. Fix the conditionals up to tolerate the non-boolean values.

Dave Hansen committed 10 years ago

Commit 8e8efe01 parent 70f15281 file · +3 −3Browse files

Unified · Split

arch/x86/mm/mpx.c+3−3

@@ -101,19 +101,19 @@ static int get_reg_offset(struct insn insn, struct pt_regs regs, · 100 unmodified lines
101	switch (type) {	101	switch (type) {
102	case REG_TYPE_RM:	102	case REG_TYPE_RM:
103	regno = X86_MODRM_RM(insn->modrm.value);	103	regno = X86_MODRM_RM(insn->modrm.value);
104	if (X86_REX_B(insn->rex_prefix.value) == 1)	104	if (X86_REX_B(insn->rex_prefix.value))
105	regno += 8;	105	regno += 8;
106	break;	106	break;
107		107
108	case REG_TYPE_INDEX:	108	case REG_TYPE_INDEX:
109	regno = X86_SIB_INDEX(insn->sib.value);	109	regno = X86_SIB_INDEX(insn->sib.value);
110	if (X86_REX_X(insn->rex_prefix.value) == 1)	110	if (X86_REX_X(insn->rex_prefix.value))
111	regno += 8;	111	regno += 8;
112	break;	112	break;
113		113
114	case REG_TYPE_BASE:	114	case REG_TYPE_BASE:
115	regno = X86_SIB_BASE(insn->sib.value);	115	regno = X86_SIB_BASE(insn->sib.value);
116	if (X86_REX_B(insn->rex_prefix.value) == 1)	116	if (X86_REX_B(insn->rex_prefix.value))
117	regno += 8;	117	regno += 8;
118	break;	118	break;
119		119