diff options
| author | Peter Zijlstra <peterz@infradead.org> | 2025-02-24 13:37:06 +0100 |
|---|---|---|
| committer | Ingo Molnar <mingo@kernel.org> | 2025-02-26 12:22:10 +0100 |
| commit | 2e044911be75ce3321c5b3d10205ac0b54f8cb92 (patch) | |
| tree | 9f0cbe22d1c848eff033384f51160c729ecf2fda | |
| parent | 5d703825fde301677e8a79b0738927490407f435 (diff) | |
x86/traps: Decode 0xEA instructions as #UD
FineIBT will start using 0xEA as #UD. Normally '0xEA' is a 'bad',
invalid instruction for the CPU.
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Reviewed-by: Kees Cook <kees@kernel.org>
Link: https://lore.kernel.org/r/20250224124200.166774696@infradead.org
| -rw-r--r-- | arch/x86/include/asm/bug.h | 1 | ||||
| -rw-r--r-- | arch/x86/kernel/traps.c | 20 |
2 files changed, 18 insertions, 3 deletions
diff --git a/arch/x86/include/asm/bug.h b/arch/x86/include/asm/bug.h index 1a5e4b3726940..bc8a2ca3c82ef 100644 --- a/arch/x86/include/asm/bug.h +++ b/arch/x86/include/asm/bug.h @@ -25,6 +25,7 @@ #define BUG_UD2 0xfffe #define BUG_UD1 0xfffd #define BUG_UD1_UBSAN 0xfffc +#define BUG_EA 0xffea #ifdef CONFIG_GENERIC_BUG diff --git a/arch/x86/kernel/traps.c b/arch/x86/kernel/traps.c index 05b86c05e446c..a02a51bf433fa 100644 --- a/arch/x86/kernel/traps.c +++ b/arch/x86/kernel/traps.c @@ -96,6 +96,7 @@ __always_inline int is_valid_bugaddr(unsigned long addr) * Check for UD1 or UD2, accounting for Address Size Override Prefixes. * If it's a UD1, further decode to determine its use: * + * FineIBT: ea (bad) * UBSan{0}: 67 0f b9 00 ud1 (%eax),%eax * UBSan{10}: 67 0f b9 40 10 ud1 0x10(%eax),%eax * static_call: 0f b9 cc ud1 %esp,%ecx @@ -113,6 +114,10 @@ __always_inline int decode_bug(unsigned long addr, s32 *imm, int *len) v = *(u8 *)(addr++); if (v == INSN_ASOP) v = *(u8 *)(addr++); + if (v == 0xea) { + *len = addr - start; + return BUG_EA; + } if (v != OPCODE_ESCAPE) return BUG_NONE; @@ -309,10 +314,16 @@ static noinstr bool handle_bug(struct pt_regs *regs) switch (ud_type) { case BUG_UD2: - if (report_bug(regs->ip, regs) == BUG_TRAP_TYPE_WARN || - handle_cfi_failure(regs) == BUG_TRAP_TYPE_WARN) { - regs->ip += ud_len; + if (report_bug(regs->ip, regs) == BUG_TRAP_TYPE_WARN) { + handled = true; + break; + } + fallthrough; + + case BUG_EA: + if (handle_cfi_failure(regs) == BUG_TRAP_TYPE_WARN) { handled = true; + break; } break; @@ -328,6 +339,9 @@ static noinstr bool handle_bug(struct pt_regs *regs) break; } + if (handled) + regs->ip += ud_len; + if (regs->flags & X86_EFLAGS_IF) raw_local_irq_disable(); instrumentation_end(); |