mirror of
https://github.com/brain-hackers/linux-brain.git
synced 2024-06-09 15:26:21 +09:00
x86/insn-eval: Use new for_each_insn_prefix() macro to loop over prefixes bytes
commit 12cb908a11b2544b5f53e9af856e6b6a90ed5533 upstream
Since insn.prefixes.nbytes can be bigger than the size of
insn.prefixes.bytes[] when a prefix is repeated, the proper check must
be
insn.prefixes.bytes[i] != 0 and i < 4
instead of using insn.prefixes.nbytes. Use the new
for_each_insn_prefix() macro which does it correctly.
Debugged by Kees Cook <keescook@chromium.org>.
[ bp: Massage commit message. ]
Fixes: 32d0b95300
("x86/insn-eval: Add utility functions to get segment selector")
Reported-by: syzbot+9b64b619f10f19d19a7c@syzkaller.appspotmail.com
Signed-off-by: Masami Hiramatsu <mhiramat@kernel.org>
Signed-off-by: Borislav Petkov <bp@suse.de>
Cc: stable@vger.kernel.org
Link: https://lkml.kernel.org/r/160697104969.3146288.16329307586428270032.stgit@devnote2
[sudip: adjust context]
Signed-off-by: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
parent
423e1b08ce
commit
ed58971beb
|
@ -70,14 +70,15 @@ static int get_seg_reg_override_idx(struct insn *insn)
|
|||
{
|
||||
int idx = INAT_SEG_REG_DEFAULT;
|
||||
int num_overrides = 0, i;
|
||||
insn_byte_t p;
|
||||
|
||||
insn_get_prefixes(insn);
|
||||
|
||||
/* Look for any segment override prefixes. */
|
||||
for (i = 0; i < insn->prefixes.nbytes; i++) {
|
||||
for_each_insn_prefix(insn, i, p) {
|
||||
insn_attr_t attr;
|
||||
|
||||
attr = inat_get_opcode_attribute(insn->prefixes.bytes[i]);
|
||||
attr = inat_get_opcode_attribute(p);
|
||||
switch (attr) {
|
||||
case INAT_MAKE_PREFIX(INAT_PFX_CS):
|
||||
idx = INAT_SEG_REG_CS;
|
||||
|
|
Loading…
Reference in New Issue
Block a user