4.19-stable patches

added patches:
	x86-insn-eval-use-new-for_each_insn_prefix-macro-to-loop-over-prefixes-bytes.patch

diff --git a/queue-4.19/series b/queue-4.19/series
index f5008ec3323441d5c6f314f52e681014f4296a09..0304a505167b0e2784cac4cf4ffefa7d2f1241c6 100644 (file)
--- a/queue-4.19/series
+++ b/queue-4.19/series
@@ -36,3 +36,4 @@ i2c-qup-fix-error-return-code-in-qup_i2c_bam_schedule_desc.patch
 dm-writecache-remove-bug-and-fail-gracefully-instead.patch
 input-i8042-fix-error-return-code-in-i8042_setup_aux.patch
 netfilter-nf_tables-avoid-false-postive-lockdep-splat.patch
+x86-insn-eval-use-new-for_each_insn_prefix-macro-to-loop-over-prefixes-bytes.patch

diff --git a/queue-4.19/x86-insn-eval-use-new-for_each_insn_prefix-macro-to-loop-over-prefixes-bytes.patch b/queue-4.19/x86-insn-eval-use-new-for_each_insn_prefix-macro-to-loop-over-prefixes-bytes.patch
new file mode 100644 (file)
index 0000000..bc8946a
--- /dev/null
+++ b/queue-4.19/x86-insn-eval-use-new-for_each_insn_prefix-macro-to-loop-over-prefixes-bytes.patch
@@ -0,0 +1,55 @@
+From foo@baz Thu Dec 10 03:09:35 PM CET 2020
+From: Masami Hiramatsu <mhiramat@kernel.org>
+Date: Thu, 3 Dec 2020 13:50:50 +0900
+Subject: x86/insn-eval: Use new for_each_insn_prefix() macro to loop over prefixes bytes
+
+From: Masami Hiramatsu <mhiramat@kernel.org>
+
+commit 12cb908a11b2544b5f53e9af856e6b6a90ed5533 upstream
+
+Since insn.prefixes.nbytes can be bigger than the size of
+insn.prefixes.bytes[] when a prefix is repeated, the proper check must
+be
+
+  insn.prefixes.bytes[i] != 0 and i < 4
+
+instead of using insn.prefixes.nbytes. Use the new
+for_each_insn_prefix() macro which does it correctly.
+
+Debugged by Kees Cook <keescook@chromium.org>.
+
+ [ bp: Massage commit message. ]
+
+Fixes: 32d0b95300db ("x86/insn-eval: Add utility functions to get segment selector")
+Reported-by: syzbot+9b64b619f10f19d19a7c@syzkaller.appspotmail.com
+Signed-off-by: Masami Hiramatsu <mhiramat@kernel.org>
+Signed-off-by: Borislav Petkov <bp@suse.de>
+Cc: stable@vger.kernel.org
+Link: https://lkml.kernel.org/r/160697104969.3146288.16329307586428270032.stgit@devnote2
+[sudip: adjust context]
+Signed-off-by: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/x86/lib/insn-eval.c |    5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/arch/x86/lib/insn-eval.c
++++ b/arch/x86/lib/insn-eval.c
+@@ -70,14 +70,15 @@ static int get_seg_reg_override_idx(stru
+ {
+       int idx = INAT_SEG_REG_DEFAULT;
+       int num_overrides = 0, i;
++      insn_byte_t p;
+ 
+       insn_get_prefixes(insn);
+ 
+       /* Look for any segment override prefixes. */
+-      for (i = 0; i < insn->prefixes.nbytes; i++) {
++      for_each_insn_prefix(insn, i, p) {
+               insn_attr_t attr;
+ 
+-              attr = inat_get_opcode_attribute(insn->prefixes.bytes[i]);
++              attr = inat_get_opcode_attribute(p);
+               switch (attr) {
+               case INAT_MAKE_PREFIX(INAT_PFX_CS):
+                       idx = INAT_SEG_REG_CS;