Commit 47b6f8c5 authored Mar 15, 2024 by Naveen N Rao Committed by Zhu Wang Mar 15, 2024

powerpc/lib: Validate size for vector operations

mainline inclusion
from mainline-v6.8-rc1
commit 8f9abaa6d7de0a70fc68acaedce290c1f96e2e59
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/I96G83
CVE: CVE-2023-52606

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=8f9abaa6d7de0a70fc68acaedce290c1f96e2e59



--------------------------------

Some of the fp/vmx code in sstep.c assume a certain maximum size for the
instructions being emulated. The size of those operations however is
determined separately in analyse_instr().

Add a check to validate the assumption on the maximum size of the
operations, so as to prevent any unintended kernel stack corruption.

Signed-off-by: Naveen N Rao <naveen@kernel.org>
Reviewed-by: Gustavo A. R. Silva <gustavoars@kernel.org>
Build-tested-by: Gustavo A. R. Silva <gustavoars@kernel.org>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://msgid.link/20231123071705.397625-1-naveen@kernel.org


Signed-off-by: Zhu Wang <wangzhu9@huawei.com>

parent 9e82708a

arch/powerpc/lib/sstep.c

+10 −0

Original line number	Diff line number	Diff line
		@@ -512,6 +512,8 @@ static int do_fp_load(struct instruction_op *op, unsigned long ea,
		} u;

		nb = GETSIZE(op->type);
		if (nb > sizeof(u))
		return -EINVAL;
		if (!address_ok(regs, ea, nb))
		return -EFAULT;
		rn = op->reg;
		@@ -562,6 +564,8 @@ static int do_fp_store(struct instruction_op *op, unsigned long ea,
		} u;

		nb = GETSIZE(op->type);
		if (nb > sizeof(u))
		return -EINVAL;
		if (!address_ok(regs, ea, nb))
		return -EFAULT;
		rn = op->reg;
		@@ -606,6 +610,9 @@ static nokprobe_inline int do_vec_load(int rn, unsigned long ea,
		u8 b[sizeof(__vector128)];
		} u = {};

		if (size > sizeof(u))
		return -EINVAL;

		if (!address_ok(regs, ea & ~0xfUL, 16))
		return -EFAULT;
		/* align to multiple of size */
		@@ -633,6 +640,9 @@ static nokprobe_inline int do_vec_store(int rn, unsigned long ea,
		u8 b[sizeof(__vector128)];
		} u;

		if (size > sizeof(u))
		return -EINVAL;

		if (!address_ok(regs, ea & ~0xfUL, 16))
		return -EFAULT;
		/* align to multiple of size */