[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [Qemu-devel] [PATCH] target-i386: Fixed syscall posssible segfault
From: |
Paolo Bonzini |
Subject: |
Re: [Qemu-devel] [PATCH] target-i386: Fixed syscall posssible segfault |
Date: |
Wed, 14 Sep 2016 22:06:50 +0200 |
User-agent: |
Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Thunderbird/45.2.0 |
On 13/09/2016 15:23, Stanislav Shmarov wrote:
> In user-mode emulation env->idt.base memory is
> allocated in linux-user/main.c with
> size 8*512 = 4096 (for 64-bit).
> When fake interrupt EXCP_SYSCALL is thrown
> do_interrupt_user checks destination privilege level
> for this fake exception, and tries to read 4 bytes
> at address base + (256 * 2^4)=4096, that causes
> segfault.
>
> Privlege level was checked only for int's, so lets
> read dpl from memory only for this case.
>
> Signed-off-by: Stanislav Shmarov <address@hidden>
Queued for 2.8, thanks.
Paolo
> ---
> target-i386/seg_helper.c | 36 +++++++++++++++++++-----------------
> 1 file changed, 19 insertions(+), 17 deletions(-)
>
> diff --git a/target-i386/seg_helper.c b/target-i386/seg_helper.c
> index 6cbdf17..fb79f31 100644
> --- a/target-i386/seg_helper.c
> +++ b/target-i386/seg_helper.c
> @@ -1137,25 +1137,27 @@ static void do_interrupt_real(CPUX86State *env, int
> intno, int is_int,
> static void do_interrupt_user(CPUX86State *env, int intno, int is_int,
> int error_code, target_ulong next_eip)
> {
> - SegmentCache *dt;
> - target_ulong ptr;
> - int dpl, cpl, shift;
> - uint32_t e2;
> + if (is_int) {
> + SegmentCache *dt;
> + target_ulong ptr;
> + int dpl, cpl, shift;
> + uint32_t e2;
>
> - dt = &env->idt;
> - if (env->hflags & HF_LMA_MASK) {
> - shift = 4;
> - } else {
> - shift = 3;
> - }
> - ptr = dt->base + (intno << shift);
> - e2 = cpu_ldl_kernel(env, ptr + 4);
> + dt = &env->idt;
> + if (env->hflags & HF_LMA_MASK) {
> + shift = 4;
> + } else {
> + shift = 3;
> + }
> + ptr = dt->base + (intno << shift);
> + e2 = cpu_ldl_kernel(env, ptr + 4);
>
> - dpl = (e2 >> DESC_DPL_SHIFT) & 3;
> - cpl = env->hflags & HF_CPL_MASK;
> - /* check privilege if software int */
> - if (is_int && dpl < cpl) {
> - raise_exception_err(env, EXCP0D_GPF, (intno << shift) + 2);
> + dpl = (e2 >> DESC_DPL_SHIFT) & 3;
> + cpl = env->hflags & HF_CPL_MASK;
> + /* check privilege if software int */
> + if (dpl < cpl) {
> + raise_exception_err(env, EXCP0D_GPF, (intno << shift) + 2);
> + }
> }
>
> /* Since we emulate only user space, we cannot do more than
>