2022-01-26 03:30:15

by Evgenii Stepanov

Subject: [PATCH v2] arm64: extable: fix load_unaligned_zeropad() reg indices

In ex_handler_load_unaligned_zeropad() we erroneously extract the data and
addr register indices from ex->type rather than ex->data. As ex->type will
contain EX_TYPE_LOAD_UNALIGNED_ZEROPAD (i.e. 4):
* We'll always treat X0 as the address register, since EX_DATA_REG_ADDR is
extracted from bits [9:5]. Thus, we may attempt to dereference an
arbitrary address as X0 may hold an arbitrary value.
* We'll always treat X4 as the data register, since EX_DATA_REG_DATA is
extracted from bits [4:0]. Thus we will corrupt X4 and cause arbitrary
behaviour within load_unaligned_zeropad() and its caller.

Fix this by extracting both values from ex->data as originally intended.

On an MTE-enabled QEMU image we are hitting the following crash:
Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000
Call trace:
fixup_exception+0xc4/0x108
__do_kernel_fault+0x3c/0x268
do_tag_check_fault+0x3c/0x104
do_mem_abort+0x44/0xf4
el1_abort+0x40/0x64
el1h_64_sync_handler+0x60/0xa0
el1h_64_sync+0x7c/0x80
link_path_walk+0x150/0x344
path_openat+0xa0/0x7dc
do_filp_open+0xb8/0x168
do_sys_openat2+0x88/0x17c
__arm64_sys_openat+0x74/0xa0
invoke_syscall+0x48/0x148
el0_svc_common+0xb8/0xf8
do_el0_svc+0x28/0x88
el0_svc+0x24/0x84
el0t_64_sync_handler+0x88/0xec
el0t_64_sync+0x1b4/0x1b8
Code: f8695a69 71007d1f 540000e0 927df12a (f940014a)

Fixes: 753b32368705 ("arm64: extable: add load_unaligned_zeropad() handler")
Cc: <[email protected]> # 5.16.x
Reviewed-by: Mark Rutland <[email protected]>
Signed-off-by: Evgenii Stepanov <[email protected]>
---
arch/arm64/mm/extable.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/arch/arm64/mm/extable.c b/arch/arm64/mm/extable.c
index c0181e60cc98..489455309695 100644
--- a/arch/arm64/mm/extable.c
+++ b/arch/arm64/mm/extable.c
@@ -40,8 +40,8 @@ static bool
ex_handler_load_unaligned_zeropad(const struct exception_table_entry *ex,
struct pt_regs *regs)
{
- int reg_data = FIELD_GET(EX_DATA_REG_DATA, ex->type);
- int reg_addr = FIELD_GET(EX_DATA_REG_ADDR, ex->type);
+ int reg_data = FIELD_GET(EX_DATA_REG_DATA, ex->data);
+ int reg_addr = FIELD_GET(EX_DATA_REG_ADDR, ex->data);
unsigned long data, addr, offset;

addr = pt_regs_read_reg(regs, reg_addr);
--
2.35.0.rc0.227.g00780c9af4-goog

2022-01-26 22:30:48

by Catalin Marinas

Subject: Re: [PATCH v2] arm64: extable: fix load_unaligned_zeropad() reg indices

On Tue, 25 Jan 2022 10:22:17 -0800, Evgenii Stepanov wrote:
> In ex_handler_load_unaligned_zeropad() we erroneously extract the data and
> addr register indices from ex->type rather than ex->data. As ex->type will
> contain EX_TYPE_LOAD_UNALIGNED_ZEROPAD (i.e. 4):
> * We'll always treat X0 as the address register, since EX_DATA_REG_ADDR is
> extracted from bits [9:5]. Thus, we may attempt to dereference an
> arbitrary address as X0 may hold an arbitrary value.
> * We'll always treat X4 as the data register, since EX_DATA_REG_DATA is
> extracted from bits [4:0]. Thus we will corrupt X4 and cause arbitrary
> behaviour within load_unaligned_zeropad() and its caller.
>
> [...]

Applied to arm64 (for-next/fixes), thanks!

[1/1] arm64: extable: fix load_unaligned_zeropad() reg indices
https://git.kernel.org/arm64/c/afa1bf69aac3

--
Catalin