insn_get_addr_ref() returns the effective address as defined by the section 3.7.5.1 Vol 1 of the Intel 64 and IA-32 Architectures Software Developer's Manual. In order to compute the linear address, we must add to the effective address the segment base address as set in the segment descriptor. The segment descriptor to use depends on the register used as operand and segment override prefixes, if any.
In most cases, the segment base address will be 0 if the USER_DS/USER32_DS segment is used or if segmentation is not used. However, the base address is not necessarily zero if a user programs defines its own segments. This is possible by using a local descriptor table. Since the effective address is a signed quantity, the unsigned segment base address is saved in a separate variable and added to the final, unsigned, effective address. Cc: Dave Hansen <[email protected]> Cc: Adam Buchbinder <[email protected]> Cc: Colin Ian King <[email protected]> Cc: Lorenzo Stoakes <[email protected]> Cc: Qiaowei Ren <[email protected]> Cc: Arnaldo Carvalho de Melo <[email protected]> Cc: Masami Hiramatsu <[email protected]> Cc: Adrian Hunter <[email protected]> Cc: Kees Cook <[email protected]> Cc: Thomas Garnier <[email protected]> Cc: Peter Zijlstra <[email protected]> Cc: Borislav Petkov <[email protected]> Cc: Dmitry Vyukov <[email protected]> Cc: Ravi V. Shankar <[email protected]> Cc: [email protected] Signed-off-by: Ricardo Neri <[email protected]> --- arch/x86/lib/insn-eval.c | 18 ++++++++++++++++-- 1 file changed, 16 insertions(+), 2 deletions(-) diff --git a/arch/x86/lib/insn-eval.c b/arch/x86/lib/insn-eval.c index 04f696c3793e..8ae110a273de 100644 --- a/arch/x86/lib/insn-eval.c +++ b/arch/x86/lib/insn-eval.c @@ -673,7 +673,7 @@ int insn_get_modrm_rm_off(struct insn *insn, struct pt_regs *regs) void __user *insn_get_addr_ref(struct insn *insn, struct pt_regs *regs) { int addr_offset, base_offset, indx_offset; - unsigned long linear_addr; + unsigned long linear_addr, seg_base_addr; long eff_addr, base, indx; insn_byte_t sib; @@ -687,6 +687,10 @@ void __user *insn_get_addr_ref(struct insn *insn, struct pt_regs *regs) goto out_err; eff_addr = regs_get_register(regs, addr_offset); + + seg_base_addr = insn_get_seg_base(regs, insn, addr_offset); + if (seg_base_addr == -1L) + goto out_err; } else { if (insn->sib.nbytes) { /* @@ -712,6 +716,11 @@ void __user *insn_get_addr_ref(struct insn *insn, struct pt_regs *regs) indx = regs_get_register(regs, indx_offset); eff_addr = base + indx * (1 << X86_SIB_SCALE(sib)); + + seg_base_addr = insn_get_seg_base(regs, insn, + base_offset); + if (seg_base_addr == -1L) + goto out_err; } else { addr_offset = get_reg_offset(insn, regs, REG_TYPE_RM); @@ -730,12 +739,17 @@ void __user *insn_get_addr_ref(struct insn *insn, struct pt_regs *regs) } else { eff_addr = regs_get_register(regs, addr_offset); } + + seg_base_addr = insn_get_seg_base(regs, insn, + addr_offset); + if (seg_base_addr == -1L) + goto out_err; } eff_addr += insn->displacement.value; } - linear_addr = (unsigned long)eff_addr; + linear_addr = (unsigned long)eff_addr + seg_base_addr; return (void __user *)linear_addr; out_err: -- 2.13.0
