From: Paolo Bonzini <pbonzini@redhat.com>
To: qemu-devel@nongnu.org
Cc: Pranith Kumar <bobby.prani@gmail.com>,
Peter Maydell <peter.maydell@linaro.org>
Subject: [Qemu-devel] [PULL 4/9] tcg/i386: Check the size of instruction being translated
Date: Mon, 27 Mar 2017 18:16:10 +0200 [thread overview]
Message-ID: <20170327161615.19637-5-pbonzini@redhat.com> (raw)
In-Reply-To: <20170327161615.19637-1-pbonzini@redhat.com>
From: Pranith Kumar <bobby.prani@gmail.com>
This fixes the bug: 'user-to-root privesc inside VM via bad translation
caching' reported by Jann Horn here:
https://bugs.chromium.org/p/project-zero/issues/detail?id=1122
Reviewed-by: Richard Henderson <rth@twiddle.net>
CC: Peter Maydell <peter.maydell@linaro.org>
CC: Paolo Bonzini <pbonzini@redhat.com>
Reported-by: Jann Horn <jannh@google.com>
Signed-off-by: Pranith Kumar <bobby.prani@gmail.com>
Message-Id: <20170323175851.14342-1-bobby.prani@gmail.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
target/i386/translate.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/target/i386/translate.c b/target/i386/translate.c
index 72c1b03..1d1372f 100644
--- a/target/i386/translate.c
+++ b/target/i386/translate.c
@@ -4418,6 +4418,13 @@ static target_ulong disas_insn(CPUX86State *env, DisasContext *s,
s->vex_l = 0;
s->vex_v = 0;
next_byte:
+ /* x86 has an upper limit of 15 bytes for an instruction. Since we
+ * do not want to decode and generate IR for an illegal
+ * instruction, the following check limits the instruction size to
+ * 25 bytes: 14 prefix + 1 opc + 6 (modrm+sib+ofs) + 4 imm */
+ if (s->pc - pc_start > 14) {
+ goto illegal_op;
+ }
b = cpu_ldub_code(env, s->pc);
s->pc++;
/* Collect prefixes. */
--
2.9.3
next prev parent reply other threads:[~2017-03-27 16:16 UTC|newest]
Thread overview: 11+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-03-27 16:16 [Qemu-devel] [PULL 0/9] Misc fixes for QEMU 2.9.0-rc2 Paolo Bonzini
2017-03-27 16:16 ` [Qemu-devel] [PULL 1/9] clear pending status before calling memory commit Paolo Bonzini
2017-03-27 16:16 ` [Qemu-devel] [PULL 2/9] virtio-scsi: Make virtio_scsi_acquire/release public Paolo Bonzini
2017-03-27 16:16 ` [Qemu-devel] [PULL 3/9] virtio-scsi: Fix acquire/release in dataplane handlers Paolo Bonzini
2017-03-27 16:16 ` Paolo Bonzini [this message]
2017-03-27 16:16 ` [Qemu-devel] [PULL 5/9] mem-prealloc: fix sysconf(_SC_NPROCESSORS_ONLN) failure case Paolo Bonzini
2017-03-27 16:16 ` [Qemu-devel] [PULL 6/9] win32: replace custom mutex and condition variable with native primitives Paolo Bonzini
2017-03-27 16:16 ` [Qemu-devel] [PULL 7/9] nbd: drop unused NBDClientSession.is_unix field Paolo Bonzini
2017-03-27 16:16 ` [Qemu-devel] [PULL 8/9] Revert "apic: save apic_delivered flag" Paolo Bonzini
2017-03-27 16:16 ` [Qemu-devel] [PULL 9/9] scsi-generic: Fill in opt_xfer_len in INQUIRY reply if it is zero Paolo Bonzini
2017-03-28 8:48 ` [Qemu-devel] [PULL 0/9] Misc fixes for QEMU 2.9.0-rc2 Peter Maydell
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20170327161615.19637-5-pbonzini@redhat.com \
--to=pbonzini@redhat.com \
--cc=bobby.prani@gmail.com \
--cc=peter.maydell@linaro.org \
--cc=qemu-devel@nongnu.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.