x86/umip: Fix insn_get_code_seg_params()'s return value
Borislav Petkov
maintainerPATCH 1/1 x86/umip: Fix insn_get_code_seg_params()'s return value
From: Borislav Petkov <[email protected]>
In order to save on redundant structs definitions insn_get_code_seg_params() was made to return two 4-bit values in a char but clang complains:
arch/x86/lib/insn-eval.c:780:10: warning: implicit conversion from 'int' to 'char'
changes value from 132 to -124 [-Wconstant-conversion]
return INSN_CODE_SEG_PARAMS(4, 8);
~~~~~~ ^~~~~~~~~~~~~~~~~~~~~~~~~~ ./arch/x86/include/asm/insn-eval.h:16:57: note: expanded from macro 'INSN_CODE_SEG_PARAMS' #define INSN_CODE_SEG_PARAMS(oper_sz, addr_sz) (oper_sz | (addr_sz << 4))
Those two values do get picked apart afterwards the opposite way of how they were ORed so wrt to the LSByte, the return value is the same.
But this function returns -EINVAL in the error case, which is an int. So make it return an int which is the native word size anyway and thus fix the clang warning.
--- arch/x86/include/asm/insn-eval.h | 2 +- arch/x86/kernel/umip.c | 2 +- arch/x86/lib/insn-eval.c | 4 ++-- 3 files changed, 4 insertions(+), 4 deletions(-)
arch/x86/include/asm/insn-eval.h +1 -1
@@ -18,6 +18,6 @@void __user *insn_get_addr_ref (struct insn *insn,struct pt_regs *regs);int insn_get_modrm_rm_off (struct insn *insn,struct pt_regs *regs);unsigned long insn_get_seg_base (struct pt_regs *regs,int seg_reg_idx); -char insn_get_code_seg_params (struct pt_regs *regs); +int insn_get_code_seg_params (struct pt_regs *regs);#endif /* _ASM_X86_INSN_EVAL_H */
arch/x86/kernel/umip.c +1 -1
@@ -319,7 +319,7 @@ bool fixup_umip_exception(struct pt_regs *regs)unsigned char buf[MAX_INSN_SIZE ];void __user *uaddr;struct insn insn; -char seg_defs; +int seg_defs;if (!regs)return false;
arch/x86/lib/insn-eval.c +2 -2
@@ -733,11 +733,11 @@ static unsigned long get_seg_limit(struct pt_regs *regs, int seg_reg_idx)* * Returns: * -* A signed 8-bit value containing the default parameters on success. +* An int containing ORed-in default parameters on success. * * -EINVAL on error. */ -char insn_get_code_seg_params (struct pt_regs *regs) +int insn_get_code_seg_params (struct pt_regs *regs) {struct desc_struct *desc;short sel;
Signature · 1 line
2.13.0
tip-bot for Borislav Petkov
merge botx86/umip: Fix insn_get_code_seg_params()'s return value
Commit-ID: e2a5dca753d1cdc3212519023ed8a13e13f5495b Gitweb: https://git.kernel.org/tip/e2a5dca753d1cdc3212519023ed8a13e13f5495b Author: Borislav Petkov <[email protected]> AuthorDate: Thu, 23 Nov 2017 10:19:51 +0100 Committer: Thomas Gleixner <[email protected]> CommitDate: Thu, 23 Nov 2017 20:17:59 +0100
x86/umip: Fix insn_get_code_seg_params()'s return value
In order to save on redundant structs definitions insn_get_code_seg_params() was made to return two 4-bit values in a char but clang complains:
arch/x86/lib/insn-eval.c:780:10: warning: implicit conversion from 'int' to 'char'
changes value from 132 to -124 [-Wconstant-conversion]
return INSN_CODE_SEG_PARAMS(4, 8);
~~~~~~ ^~~~~~~~~~~~~~~~~~~~~~~~~~ ./arch/x86/include/asm/insn-eval.h:16:57: note: expanded from macro 'INSN_CODE_SEG_PARAMS' #define INSN_CODE_SEG_PARAMS(oper_sz, addr_sz) (oper_sz | (addr_sz << 4))
Those two values do get picked apart afterwards the opposite way of how they were ORed so wrt to the LSByte, the return value is the same.
But this function returns -EINVAL in the error case, which is an int. So make it return an int which is the native word size anyway and thus fix the clang warning.
--- arch/x86/include/asm/insn-eval.h | 2 +- arch/x86/kernel/umip.c | 2 +- arch/x86/lib/insn-eval.c | 4 ++-- 3 files changed, 4 insertions(+), 4 deletions(-)
arch/x86/include/asm/insn-eval.h +1 -1
@@ -18,6 +18,6 @@void __user *insn_get_addr_ref (struct insn *insn,struct pt_regs *regs);int insn_get_modrm_rm_off (struct insn *insn,struct pt_regs *regs);unsigned long insn_get_seg_base (struct pt_regs *regs,int seg_reg_idx); -char insn_get_code_seg_params (struct pt_regs *regs); +int insn_get_code_seg_params (struct pt_regs *regs);#endif /* _ASM_X86_INSN_EVAL_H */
arch/x86/kernel/umip.c +1 -1
@@ -319,7 +319,7 @@ bool fixup_umip_exception(struct pt_regs *regs)unsigned char buf[MAX_INSN_SIZE ];void __user *uaddr;struct insn insn; -char seg_defs; +int seg_defs;if (!regs)return false;
arch/x86/lib/insn-eval.c +2 -2
@@ -733,11 +733,11 @@ static unsigned long get_seg_limit(struct pt_regs *regs, int seg_reg_idx)* * Returns: * -* A signed 8-bit value containing the default parameters on success. +* An int containing ORed-in default parameters on success. * * -EINVAL on error. */ -char insn_get_code_seg_params (struct pt_regs *regs) +int insn_get_code_seg_params (struct pt_regs *regs) {struct desc_struct *desc;short sel;
Quoted 16 lines · Borislav Petkov
From: Borislav Petkov <[email protected]>
In order to save on redundant structs definitions
insn_get_code_seg_params()was made to return two 4-bit values in a char but clang complains:
arch/x86/lib/insn-eval.c:780:10: warning: implicit conversion from 'int' to 'char'changes value from 132 to -124 [-Wconstant-conversion] return INSN_CODE_SEG_PARAMS(4, 8); ~~~~~~ ^~~~~~~~~~~~~~~~~~~~~~~~~~
./arch/x86/include/asm/insn-eval.h:16:57: note: expanded from macro 'INSN_CODE_SEG_PARAMS' #defineINSN_CODE_SEG_PARAMS(oper_sz, addr_sz)(oper_sz| (addr_sz<< 4))Those two values do get picked apart afterwards the opposite way of how they were ORed so wrt to the LSByte, the return value is the same.
Quoted 8 lines
But this function returns
-EINVALin the error case, which is an int. So make it return an int which is the native word size anyway and thus fix the clang warning.Signed-off-by Borislav Petkov <[email protected]>Reported-by Kees Cook <[email protected]>Reported-by Nick Desaulniers <[email protected]>
Thanks Kees and Nick for finding this bug. Thanks Borislav for the quick fix! This change looks OK to me.
BR,
Ricardo