3758a6c74e
In ex_handler_load_unaligned_zeropad() we erroneously extract the data and
addr register indices from ex->type rather than ex->data. As ex->type will
contain EX_TYPE_LOAD_UNALIGNED_ZEROPAD (i.e. 4):
* We'll always treat X0 as the address register, since EX_DATA_REG_ADDR is
extracted from bits [9:5]. Thus, we may attempt to dereference an
arbitrary address as X0 may hold an arbitrary value.
* We'll always treat X4 as the data register, since EX_DATA_REG_DATA is
extracted from bits [4:0]. Thus we will corrupt X4 and cause arbitrary
behaviour within load_unaligned_zeropad() and its caller.
Fix this by extracting both values from ex->data as originally intended.
On an MTE-enabled QEMU image we are hitting the following crash:
Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000
Call trace:
fixup_exception+0xc4/0x108
__do_kernel_fault+0x3c/0x268
do_tag_check_fault+0x3c/0x104
do_mem_abort+0x44/0xf4
el1_abort+0x40/0x64
el1h_64_sync_handler+0x60/0xa0
el1h_64_sync+0x7c/0x80
link_path_walk+0x150/0x344
path_openat+0xa0/0x7dc
do_filp_open+0xb8/0x168
do_sys_openat2+0x88/0x17c
__arm64_sys_openat+0x74/0xa0
invoke_syscall+0x48/0x148
el0_svc_common+0xb8/0xf8
do_el0_svc+0x28/0x88
el0_svc+0x24/0x84
el0t_64_sync_handler+0x88/0xec
el0t_64_sync+0x1b4/0x1b8
Code: f8695a69 71007d1f 540000e0 927df12a (f940014a)
Fixes: 753b32368705 ("arm64: extable: add load_unaligned_zeropad() handler")
Cc: <stable@vger.kernel.org> # 5.16.x
Reviewed-by: Mark Rutland <mark.rutland@arm.com>
Signed-off-by: Evgenii Stepanov <eugenis@google.com>
Link: https://lore.kernel.org/r/20220125182217.2605202-1-eugenis@google.com
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
87 lines
1.8 KiB
C
87 lines
1.8 KiB
C
// SPDX-License-Identifier: GPL-2.0
|
|
/*
|
|
* Based on arch/arm/mm/extable.c
|
|
*/
|
|
|
|
#include <linux/bitfield.h>
|
|
#include <linux/extable.h>
|
|
#include <linux/uaccess.h>
|
|
|
|
#include <asm/asm-extable.h>
|
|
#include <asm/ptrace.h>
|
|
|
|
static inline unsigned long
|
|
get_ex_fixup(const struct exception_table_entry *ex)
|
|
{
|
|
return ((unsigned long)&ex->fixup + ex->fixup);
|
|
}
|
|
|
|
static bool ex_handler_fixup(const struct exception_table_entry *ex,
|
|
struct pt_regs *regs)
|
|
{
|
|
regs->pc = get_ex_fixup(ex);
|
|
return true;
|
|
}
|
|
|
|
static bool ex_handler_uaccess_err_zero(const struct exception_table_entry *ex,
|
|
struct pt_regs *regs)
|
|
{
|
|
int reg_err = FIELD_GET(EX_DATA_REG_ERR, ex->data);
|
|
int reg_zero = FIELD_GET(EX_DATA_REG_ZERO, ex->data);
|
|
|
|
pt_regs_write_reg(regs, reg_err, -EFAULT);
|
|
pt_regs_write_reg(regs, reg_zero, 0);
|
|
|
|
regs->pc = get_ex_fixup(ex);
|
|
return true;
|
|
}
|
|
|
|
static bool
|
|
ex_handler_load_unaligned_zeropad(const struct exception_table_entry *ex,
|
|
struct pt_regs *regs)
|
|
{
|
|
int reg_data = FIELD_GET(EX_DATA_REG_DATA, ex->data);
|
|
int reg_addr = FIELD_GET(EX_DATA_REG_ADDR, ex->data);
|
|
unsigned long data, addr, offset;
|
|
|
|
addr = pt_regs_read_reg(regs, reg_addr);
|
|
|
|
offset = addr & 0x7UL;
|
|
addr &= ~0x7UL;
|
|
|
|
data = *(unsigned long*)addr;
|
|
|
|
#ifndef __AARCH64EB__
|
|
data >>= 8 * offset;
|
|
#else
|
|
data <<= 8 * offset;
|
|
#endif
|
|
|
|
pt_regs_write_reg(regs, reg_data, data);
|
|
|
|
regs->pc = get_ex_fixup(ex);
|
|
return true;
|
|
}
|
|
|
|
bool fixup_exception(struct pt_regs *regs)
|
|
{
|
|
const struct exception_table_entry *ex;
|
|
|
|
ex = search_exception_tables(instruction_pointer(regs));
|
|
if (!ex)
|
|
return false;
|
|
|
|
switch (ex->type) {
|
|
case EX_TYPE_FIXUP:
|
|
return ex_handler_fixup(ex, regs);
|
|
case EX_TYPE_BPF:
|
|
return ex_handler_bpf(ex, regs);
|
|
case EX_TYPE_UACCESS_ERR_ZERO:
|
|
return ex_handler_uaccess_err_zero(ex, regs);
|
|
case EX_TYPE_LOAD_UNALIGNED_ZEROPAD:
|
|
return ex_handler_load_unaligned_zeropad(ex, regs);
|
|
}
|
|
|
|
BUG();
|
|
}
|