Section of the Intel 64 and IA-32 Architectures Software
Developer's Manual volume 2A states that when memory addressing is used
(i.e., mod part of ModR/M is not 3), a SIB byte is used and the index of
the SIB byte points to the R/ESP (i.e., index = 4), the index should not be
used in the computation of the memory address.

In these cases the address is simply the value present in the register
pointed by the base part of the SIB byte plus the displacement byte.

An example of such instruction could be

    insn -0x80(%rsp)

This is represented as:

     [opcode] 4c 23 80

      ModR/M=0x4c: mod: 0x1, reg: 0x1: r/m: 0x4(R/ESP)
      SIB=0x23: sc: 0, index: 0x100(R/ESP), base: 0x11(R/EBX):
      Displacement -0x80

The correct address is (base) + displacement; no index is used.

We can achieve the desired effect of not using the index by making
get_reg_offset return -EDOM in this particular case. This value indicates
callers that they should not use the index to calculate the address.
EINVAL continues to indicate that an error when decoding the SIB byte.

Care is taken to allow R12 to be used as index, which is a valid scenario.

Cc: Dave Hansen <>
Cc: Adam Buchbinder <>
Cc: Colin Ian King <>
Cc: Lorenzo Stoakes <>
Cc: Qiaowei Ren <>
Cc: Ravi V. Shankar <>
Signed-off-by: Ricardo Neri <>
 arch/x86/mm/mpx.c | 20 ++++++++++++++++++--
 1 file changed, 18 insertions(+), 2 deletions(-)

diff --git a/arch/x86/mm/mpx.c b/arch/x86/mm/mpx.c
index 86c2d96..6a034bc 100644
--- a/arch/x86/mm/mpx.c
+++ b/arch/x86/mm/mpx.c
@@ -110,6 +110,13 @@ static int get_reg_offset(struct insn *insn, struct 
pt_regs *regs,
                regno = X86_SIB_INDEX(insn->sib.value);
                if (X86_REX_X(insn->rex_prefix.value))
                        regno += 8;
+               /*
+                * If mod !=3, register R/ESP (regno=4) is not used as index in
+                * the address computation. Check is done after looking at REX.X
+                * This is because R12 (regno=12) can be used as an index.
+                */
+               if (regno == 4 && X86_MODRM_MOD(insn->modrm.value) != 3)
+                       return -EDOM;
        case REG_TYPE_BASE:
@@ -158,11 +165,20 @@ static void __user *mpx_get_addr_ref(struct insn *insn, 
struct pt_regs *regs)
                                goto out_err;
                        indx_offset = get_reg_offset(insn, regs, 
+                       /*
+                        * A negative offset generally means a error, except
+                        * -EDOM, which means that the contents of the register
+                        * should not be used as index.
+                        */
                        if (indx_offset < 0)
-                               goto out_err;
+                               if (indx_offset == -EDOM)
+                                       indx = 0;
+                               else
+                                       goto out_err;
+                       else
+                               indx = regs_get_register(regs, indx_offset);
                        base = regs_get_register(regs, base_offset);
-                       indx = regs_get_register(regs, indx_offset);
                        addr = base + indx * (1 << X86_SIB_SCALE(sib));
                } else {
                        addr_offset = get_reg_offset(insn, regs, REG_TYPE_RM);

To unsubscribe from this list: send the line "unsubscribe linux-msdos" in
the body of a message to
More majordomo info at

Reply via email to