Patch "x86/asm/decoder: Fix and enforce max instruction size in the insn decoder" has been added to the 4.0-stable tree

This is a note to let you know that I've just added the patch titled

x86/asm/decoder: Fix and enforce max instruction size in the insn decoder

to the 4.0-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
x86-asm-decoder-fix-and-enforce-max-instruction-size-in-the-insn-decoder.patch
and it can be found in the queue-4.0 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

From: Andy Lutomirski <[email protected]>
Date: Tue, 27 Jan 2015 16:06:02 -0800
Subject: x86/asm/decoder: Fix and enforce max instruction size in the insn decoder

From: Andy Lutomirski <[email protected]>

commit 91e5ed49fca09c2b83b262b9757d1376ee2b46c3 upstream.

x86 instructions cannot exceed 15 bytes, and the instruction decoder should enforce that. Prior to 6ba48ff46f76, the instruction length limit was implicitly set to 16, which was an approximation of 15, but there is currently no limit at all.

Fix MAX_INSN_SIZE (it should be 15, not 16), and fix the decoder to reject instructions that exceed MAX_INSN_SIZE.

Other than potentially confusing some of the decoder sanity checks, I'm not aware of any actual problems that omitting this check would cause, nor am I aware of any practical problems caused by the MAX_INSN_SIZE error.

---
 arch/x86/include/asm/insn.h |    2 +-
 arch/x86/lib/insn.c         |    7 +++++++
 2 files changed, 8 insertions(+), 1 deletion(-)

@@ -69,7 +69,7 @@ struct insn {
 	const insn_byte_t *next_byte;
 };
 
-#define MAX_INSN_SIZE	16
+#define MAX_INSN_SIZE	15
 
 #define X86_MODRM_MOD(modrm) (((modrm) & 0xc0) >> 6)
 #define X86_MODRM_REG(modrm) (((modrm) & 0x38) >> 3)

@@ -52,6 +52,13 @@
  */
 void insn_init(struct insn *insn, const void *kaddr, int buf_len, int x86_64)
 {
+	/*
+	 * Instructions longer than MAX_INSN_SIZE (15 bytes) are invalid
+	 * even if the input buffer is long enough to hold them.
+	 */
+	if (buf_len > MAX_INSN_SIZE)
+		buf_len = MAX_INSN_SIZE;
+
 	memset(insn, 0, sizeof(*insn));
 	insn->kaddr = kaddr;
 	insn->end_kaddr = kaddr + buf_len;

Patches currently in stable-queue which might be from [email protected] are

queue-4.0/x86-asm-decoder-fix-and-enforce-max-instruction-size-in-the-insn-decoder.patch