From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from us-smtp-1.mimecast.com (us-smtp-1.mimecast.com [207.211.31.81]) by sourceware.org (Postfix) with ESMTP id 14F3E3857C7C for ; Wed, 15 Jul 2020 17:09:47 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.3.2 sourceware.org 14F3E3857C7C Received: from mail-il1-f198.google.com (mail-il1-f198.google.com [209.85.166.198]) (Using TLS) by relay.mimecast.com with ESMTP id us-mta-399-sTaQhBU2OiOwjeWt5OF49Q-1; Wed, 15 Jul 2020 13:09:44 -0400 X-MC-Unique: sTaQhBU2OiOwjeWt5OF49Q-1 Received: by mail-il1-f198.google.com with SMTP id s137so1750542ilc.18 for ; Wed, 15 Jul 2020 10:09:44 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:from:date:message-id:subject:to; bh=SwWjKh1JIMF3sbrw9z9PXVDvt4w/66lGjXArq8QiJRY=; b=CBZbwkwfKFZM8PC+GVwuljvAcEuUGQbhtfsdBEPPeCU6acH8t26MgF6t4Ph+FMkLD8 biDPBllF/6/F2Do3lWeE/vnyNhxHpi56BwLqBNf/OCv8NCT8mA4mHNvl2rI+5vlbP+1/ ikAKmH88d1c4DBcKQzsYE9c6C7U1MkmFG56MIUFP7DYmfZfaoZkwNptC4q4tjoLESyFY 2BPnPbRCUD1STQo1JyIATYRu1GvztJniM3TWIAptneCLmmZmkjB0hFy7rRcqwhAX1Biv Sk+7RswEHmWa7EYLbve3kcAOQR3d1K/+7tc4TukQFzdmDwsB8EuUD2ujPVATFy8QlQNN v/cA== X-Gm-Message-State: AOAM5329lqtYuszDSDogam27bekzPds+dF7d4xxhmM28HXfP7dvDLGuM qqAPFNsEzTdmzkCI1g5ZBoZmqGChEtP+5KeVoksAiDhmVrIOwNWPkMeQKctk6CxTrzo7Ugithho lVHzrj05X9kTBFtCUOpdwVIkS4q4U4gN8MM0ekQ== X-Received: by 2002:a05:6e02:13e2:: with SMTP id w2mr480865ilj.9.1594832983978; Wed, 15 Jul 2020 10:09:43 -0700 (PDT) X-Google-Smtp-Source: ABdhPJzPtryc/VqoyvjYTpGLau7wvo2PETXVZFXHgPfTEwLYpSPwYwugdrqqJiEK7QI4nv+R87Ioydmt+Q5yCDzsrZ8= X-Received: by 2002:a05:6e02:13e2:: with SMTP id w2mr480847ilj.9.1594832983743; Wed, 15 Jul 2020 10:09:43 -0700 (PDT) MIME-Version: 1.0 From: Patsy Griffin Date: Wed, 15 Jul 2020 13:09:07 -0400 Message-ID: Subject: [2.31 COMMITTED 2/2] arm: CVE-2020-6096: Fix multiarch memcpy for negative length [BZ #25620] To: libc-stable@sourceware.org X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com Content-Type: text/plain; charset="UTF-8" X-Spam-Status: No, score=-11.9 required=5.0 tests=BAYES_00, DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, DKIM_VALID_EF, GIT_PATCH_0, RCVD_IN_DNSWL_NONE, RCVD_IN_MSPIKE_H3, RCVD_IN_MSPIKE_WL, SPF_HELO_NONE, SPF_PASS, TXREP autolearn=ham autolearn_force=no version=3.4.2 X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on server2.sourceware.org X-BeenThere: libc-stable@sourceware.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Libc-stable mailing list List-Unsubscribe: , List-Archive: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 15 Jul 2020 17:09:48 -0000 >From 64246fccafc221cc15a8b70710a9d47a60653c0d Mon Sep 17 00:00:00 2001 From: Alexander Anisimov Date: Wed, 8 Jul 2020 14:18:31 +0200 Subject: [PATCH 2/2] arm: CVE-2020-6096: Fix multiarch memcpy for negative length [BZ #25620] Unsigned branch instructions could be used for r2 to fix the wrong behavior when a negative length is passed to memcpy. This commit fixes the armv7 version. (cherry picked from commit beea361050728138b82c57dda0c4810402d342b9) --- sysdeps/arm/armv7/multiarch/memcpy_impl.S | 22 +++++++++++----------- 1 file changed, 11 insertions(+), 11 deletions(-) diff --git a/sysdeps/arm/armv7/multiarch/memcpy_impl.S b/sysdeps/arm/armv7/multiarch/memcpy_impl.S index bf4ac7077f..379bb56fc9 100644 --- a/sysdeps/arm/armv7/multiarch/memcpy_impl.S +++ b/sysdeps/arm/armv7/multiarch/memcpy_impl.S @@ -268,7 +268,7 @@ ENTRY(memcpy) mov dst, dstin /* Preserve dstin, we need to return it. */ cmp count, #64 - bge .Lcpy_not_short + bhs .Lcpy_not_short /* Deal with small copies quickly by dropping straight into the exit block. */ @@ -351,10 +351,10 @@ ENTRY(memcpy) 1: subs tmp2, count, #64 /* Use tmp2 for count. */ - blt .Ltail63aligned + blo .Ltail63aligned cmp tmp2, #512 - bge .Lcpy_body_long + bhs .Lcpy_body_long .Lcpy_body_medium: /* Count in tmp2. */ #ifdef USE_VFP @@ -378,7 +378,7 @@ ENTRY(memcpy) add src, src, #64 vstr d1, [dst, #56] add dst, dst, #64 - bge 1b + bhs 1b tst tmp2, #0x3f beq .Ldone @@ -412,7 +412,7 @@ ENTRY(memcpy) ldrd A_l, A_h, [src, #64]! strd A_l, A_h, [dst, #64]! subs tmp2, tmp2, #64 - bge 1b + bhs 1b tst tmp2, #0x3f bne 1f ldr tmp2,[sp], #FRAME_SIZE @@ -482,7 +482,7 @@ ENTRY(memcpy) add src, src, #32 subs tmp2, tmp2, #prefetch_lines * 64 * 2 - blt 2f + blo 2f 1: cpy_line_vfp d3, 0 cpy_line_vfp d4, 64 @@ -494,7 +494,7 @@ ENTRY(memcpy) add dst, dst, #2 * 64 add src, src, #2 * 64 subs tmp2, tmp2, #prefetch_lines * 64 - bge 1b + bhs 1b 2: cpy_tail_vfp d3, 0 @@ -615,8 +615,8 @@ ENTRY(memcpy) 1: pld [src, #(3 * 64)] subs count, count, #64 - ldrmi tmp2, [sp], #FRAME_SIZE - bmi .Ltail63unaligned + ldrlo tmp2, [sp], #FRAME_SIZE + blo .Ltail63unaligned pld [src, #(4 * 64)] #ifdef USE_NEON @@ -633,7 +633,7 @@ ENTRY(memcpy) neon_load_multi d0-d3, src neon_load_multi d4-d7, src subs count, count, #64 - bmi 2f + blo 2f 1: pld [src, #(4 * 64)] neon_store_multi d0-d3, dst @@ -641,7 +641,7 @@ ENTRY(memcpy) neon_store_multi d4-d7, dst neon_load_multi d4-d7, src subs count, count, #64 - bpl 1b + bhs 1b 2: neon_store_multi d0-d3, dst neon_store_multi d4-d7, dst -- 2.21.1