Minki/linux
1
0
Fork 1
mirror of https://github.com/torvalds/linux.git synced 2024-11-25 13:41:51 +00:00
Code Issues Packages Projects Releases Wiki Activity

KVM: x86: Fix uninitialized op->type for some immediate values

Browse Source 
The emulator could reuse an op->type from a previous instruction for some
immediate values.  If it mistakenly considers the operands as memory
operands, it will performs a memory read and overwrite op->val.

Consider for instance the ROR instruction - src2 (the number of times)
would be read from memory instead of being used as immediate.

Mark every immediate operand as such to avoid this problem.

Cc: stable@vger.kernel.org
Fixes: c44b4c6ab8
Signed-off-by: Nadav Amit <namit@cs.technion.ac.il>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
This commit is contained in:
Nadav Amit 2014-11-02 11:54:47 +02:00 committed by Paolo Bonzini
parent bc79a3179a
commit d29b9d7ed7
1 changed files with 8 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
arch/x86/kvm/emulate.c
View File

@ -4287,6 +4287,7 @@ static int decode_operand(struct x86_emulate_ctxt *ctxt, struct operand *op,
fetch_register_operand(op); fetch_register_operand(op);
break; break;
case OpCL: case OpCL:
op->type = OP_IMM;
op->bytes = 1; op->bytes = 1;
op->val = reg_read(ctxt, VCPU_REGS_RCX) & 0xff; op->val = reg_read(ctxt, VCPU_REGS_RCX) & 0xff;
break; break;
@ -4294,6 +4295,7 @@ static int decode_operand(struct x86_emulate_ctxt *ctxt, struct operand *op,
rc = decode_imm(ctxt, op, 1, true); rc = decode_imm(ctxt, op, 1, true);
break; break;
case OpOne: case OpOne:
op->type = OP_IMM;
op->bytes = 1; op->bytes = 1;
op->val = 1; op->val = 1;
break; break;
@ -4352,21 +4354,27 @@ static int decode_operand(struct x86_emulate_ctxt *ctxt, struct operand *op,
ctxt->memop.bytes = ctxt->op_bytes + 2; ctxt->memop.bytes = ctxt->op_bytes + 2;
goto mem_common; goto mem_common;
case OpES: case OpES:
op->type = OP_IMM;
op->val = VCPU_SREG_ES; op->val = VCPU_SREG_ES;
break; break;
case OpCS: case OpCS:
op->type = OP_IMM;
op->val = VCPU_SREG_CS; op->val = VCPU_SREG_CS;
break; break;
case OpSS: case OpSS:
op->type = OP_IMM;
op->val = VCPU_SREG_SS; op->val = VCPU_SREG_SS;
break; break;
case OpDS: case OpDS:
op->type = OP_IMM;
op->val = VCPU_SREG_DS; op->val = VCPU_SREG_DS;
break; break;
case OpFS: case OpFS:
op->type = OP_IMM;
op->val = VCPU_SREG_FS; op->val = VCPU_SREG_FS;
break; break;
case OpGS: case OpGS:
op->type = OP_IMM;
op->val = VCPU_SREG_GS; op->val = VCPU_SREG_GS;
break; break;
case OpImplicit: case OpImplicit: