Re: [PATCH] arm64: mops: Do not dereference src reg for a set operation
From: Marc Zyngier
Date: Wed Mar 26 2025 - 05:39:35 EST
On Wed, 26 Mar 2025 07:02:55 +0000,
Keir Fraser <keirf@xxxxxxxxxx> wrote:
>
> The register is not defined and reading it can result in a UBSAN
> out-of-bounds array access error, specifically when the srcreg field
> value is 31.
Gah, XZR/SP encoding strikes back...
>
> Cc: Kristina Martsenko <kristina.martsenko@xxxxxxx>
> Cc: Catalin Marinas <catalin.marinas@xxxxxxx>
> Cc: Mark Rutland <mark.rutland@xxxxxxx>
> Cc: Will Deacon <will@xxxxxxxxxx>
> Cc: Marc Zyngier <maz@xxxxxxxxxx>
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Keir Fraser <keirf@xxxxxxxxxx>
> ---
> arch/arm64/include/asm/traps.h | 4 ++--
> 1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/arch/arm64/include/asm/traps.h b/arch/arm64/include/asm/traps.h
> index d780d1bd2eac..82cf1f879c61 100644
> --- a/arch/arm64/include/asm/traps.h
> +++ b/arch/arm64/include/asm/traps.h
> @@ -109,10 +109,9 @@ static inline void arm64_mops_reset_regs(struct user_pt_regs *regs, unsigned lon
> int dstreg = ESR_ELx_MOPS_ISS_DESTREG(esr);
> int srcreg = ESR_ELx_MOPS_ISS_SRCREG(esr);
> int sizereg = ESR_ELx_MOPS_ISS_SIZEREG(esr);
> - unsigned long dst, src, size;
> + unsigned long dst, size;
>
> dst = regs->regs[dstreg];
> - src = regs->regs[srcreg];
> size = regs->regs[sizereg];
>
> /*
> @@ -129,6 +128,7 @@ static inline void arm64_mops_reset_regs(struct user_pt_regs *regs, unsigned lon
> }
> } else {
> /* CPY* instruction */
> + unsigned long src = regs->regs[srcreg];
> if (!(option_a ^ wrong_option)) {
> /* Format is from Option B */
> if (regs->pstate & PSR_N_BIT) {
Reviewed-by: Marc Zyngier <maz@xxxxxxxxxx>
M.
--
Without deviation from the norm, progress is not possible.