arm64: extable: fix load_unaligned_zeropad() reg indices
Subsystems (2)
PATCH v2 1/1 arm64: extable: fix load_unaligned_zeropad() reg indices
In ex_handler_load_unaligned_zeropad() we erroneously extract the data and addr register indices from ex->type rather than ex->data. As ex->type will contain EX_TYPE_LOAD_UNALIGNED_ZEROPAD (i.e. 4):
* We'll always treat X0 as the address register, since EX_DATA_REG_ADDR is extracted from bits [9:5]. Thus, we may attempt to dereference an arbitrary address as X0 may hold an arbitrary value.
* We'll always treat X4 as the data register, since EX_DATA_REG_DATA is extracted from bits [4:0]. Thus we will corrupt X4 and cause arbitrary behaviour within load_unaligned_zeropad() and its caller.
Fix this by extracting both values from ex->data as originally intended.
On an MTE-enabled QEMU image we are hitting the following crash:
Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 Call trace: fixup_exception+0xc4/0x108 __do_kernel_fault+0x3c/0x268 do_tag_check_fault+0x3c/0x104 do_mem_abort+0x44/0xf4 el1_abort+0x40/0x64 el1h_64_sync_handler+0x60/0xa0 el1h_64_sync+0x7c/0x80 link_path_walk+0x150/0x344 path_openat+0xa0/0x7dc do_filp_open+0xb8/0x168 do_sys_openat2+0x88/0x17c __arm64_sys_openat+0x74/0xa0 invoke_syscall+0x48/0x148 el0_svc_common+0xb8/0xf8 do_el0_svc+0x28/0x88 el0_svc+0x24/0x84 el0t_64_sync_handler+0x88/0xec el0t_64_sync+0x1b4/0x1b8 Code: f8695a69 71007d1f 540000e0 927df12a (f940014a)
--- arch/arm64/mm/extable.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/arm64/mm/extable.c +2 -2
@@ -40,8 +40,8 @@ static bool ex_handler_load_unaligned_zeropad(const struct exception_table_entry *ex, struct pt_regs *regs) { - int reg_data = FIELD_GET(EX_DATA_REG_DATA, ex->type); -int reg_addr =FIELD_GET (EX_DATA_REG_ADDR , ex->type); + int reg_data = FIELD_GET(EX_DATA_REG_DATA, ex->data); +int reg_addr =FIELD_GET (EX_DATA_REG_ADDR , ex->data);unsigned long data, addr, offset; addr =pt_regs_read_reg (regs, reg_addr);
Signature · 1 line
2.35.0.rc0.227.g00780c9af4-goog
Quoted 11 lines · Evgenii Stepanov
In
ex_handler_load_unaligned_zeropad()we erroneously extract the data and addr register indices fromex->typerather thanex->data. Asex->typewill containEX_TYPE_LOAD_UNALIGNED_ZEROPAD(i.e. 4):
* We'll always treat X0 as the address register, sinceEX_DATA_REG_ADDRis extracted from bits [9:5]. Thus, we may attempt to dereference an arbitrary address as X0 may hold an arbitrary value.
* We'll always treat X4 as the data register, sinceEX_DATA_REG_DATAis extracted from bits [4:0]. Thus we will corrupt X4 and cause arbitrary behaviour withinload_unaligned_zeropad()and its caller.[...]
Applied to arm64 (for-next/fixes), thanks!
[1/1] arm64: extable: fix load_unaligned_zeropad() reg indices
https://git.kernel.org/arm64/c/afa1bf69aac3
Signature · 1 line
Catalin