Evgenii Stepanov 3758a6c74e arm64: extable: fix load_unaligned_zeropad() reg indices ... In ex_handler_load_unaligned_zeropad() we erroneously extract the data and addr register indices from ex->type rather than ex->data. As ex->type will contain EX_TYPE_LOAD_UNALIGNED_ZEROPAD (i.e. 4): * We'll always treat X0 as the address register, since EX_DATA_REG_ADDR is extracted from bits [9:5]. Thus, we may attempt to dereference an arbitrary address as X0 may hold an arbitrary value. * We'll always treat X4 as the data register, since EX_DATA_REG_DATA is extracted from bits [4:0]. Thus we will corrupt X4 and cause arbitrary behaviour within load_unaligned_zeropad() and its caller. Fix this by extracting both values from ex->data as originally intended. On an MTE-enabled QEMU image we are hitting the following crash: Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 Call trace: fixup_exception+0xc4/0x108 __do_kernel_fault+0x3c/0x268 do_tag_check_fault+0x3c/0x104 do_mem_abort+0x44/0xf4 el1_abort+0x40/0x64 el1h_64_sync_handler+0x60/0xa0 el1h_64_sync+0x7c/0x80 link_path_walk+0x150/0x344 path_openat+0xa0/0x7dc do_filp_open+0xb8/0x168 do_sys_openat2+0x88/0x17c __arm64_sys_openat+0x74/0xa0 invoke_syscall+0x48/0x148 el0_svc_common+0xb8/0xf8 do_el0_svc+0x28/0x88 el0_svc+0x24/0x84 el0t_64_sync_handler+0x88/0xec el0t_64_sync+0x1b4/0x1b8 Code: f8695a69 71007d1f 540000e0 927df12a (f940014a) Fixes: 753b323687 ("arm64: extable: add load_unaligned_zeropad() handler") Cc: <stable@vger.kernel.org> # 5.16.x Reviewed-by: Mark Rutland <mark.rutland@arm.com> Signed-off-by: Evgenii Stepanov <eugenis@google.com> Link: https://lore.kernel.org/r/20220125182217.2605202-1-eugenis@google.com Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>		2022-01-26 18:58:12 +00:00
..
cache.S	arm64: remove __dma_*_area() aliases	2021-12-15 11:19:41 +00:00
context.c	arm64: mm: Use asid feature macro for cheanup	2021-12-10 18:24:20 +00:00
copypage.c	arm64: mte: reset the page tag in page->flags	2020-12-22 12:55:07 -08:00
dma-mapping.c	iommu/dma: Pass address limit rather than size to iommu_setup_dma_ops()	2021-06-25 15:02:43 +02:00
extable.c	arm64: extable: fix load_unaligned_zeropad() reg indices	2022-01-26 18:58:12 +00:00
fault.c	Merge branch 'signal-for-v5.17' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace	2022-01-17 05:49:30 +02:00
flush.c	arm64: Rename arm64-internal cache maintenance functions	2021-05-25 19:27:49 +01:00
hugetlbpage.c	Merge branch 'for-next/fixes' into for-next/core	2021-10-29 12:27:53 +01:00
init.c	arm64: mm: apply __ro_after_init to memory_limit	2022-01-20 09:15:16 +00:00
ioremap.c	arm64: decouple check whether pfn is in linear map from pfn_valid()	2021-06-30 20:47:29 -07:00
kasan_init.c	kasan: add kasan mode messages when kasan init	2021-11-11 09:34:35 -08:00
Makefile	arm64: trans_pgd: hibernate: Add trans_pgd_copy_el2_vectors	2021-10-01 13:30:59 +01:00
mmap.c	arm64: Include linux/io.h in mm/mmap.c	2021-01-27 12:52:16 +00:00
mmu.c	arm64 fixes for -rc1	2021-11-10 11:29:30 -08:00
mteswap.c	arm64: mte: reset the page tag in page->flags	2020-12-22 12:55:07 -08:00
pageattr.c	set_memory: allow querying whether set_direct_map_*() is actually enabled	2021-07-08 11:48:20 -07:00
pgd.c
physaddr.c	arm64: Do not pass tagged addresses to __is_lm_address()	2021-02-02 17:44:47 +00:00
proc.S	arm64: kasan: mte: use a constant kernel GCR_EL1 value	2021-08-02 18:14:21 +01:00
ptdump_debugfs.c	arm64: Add __init section marker to some functions	2021-04-08 17:45:10 +01:00
ptdump.c	arm64/bpf: Remove 128MB limit for BPF JIT programs	2021-11-08 22:16:26 +01:00
trans_pgd-asm.S	arm64: kexec: configure EL2 vectors for kexec	2021-10-01 13:31:00 +01:00
trans_pgd.c	arm64: trans_pgd: remove trans_pgd_map_page()	2021-10-01 13:31:01 +01:00