KVM: x86: Fix uninitialized op->type for some immediate values (d29b9d7e) · Commits · 戴 / test

The emulator could reuse an op->type from a previous instruction for some immediate values. If it mistakenly considers the operands as memory operands, it will performs a memory read and overwrite op->val. Consider for instance the ROR instruction - src2 (the number of times) would be read from memory instead of being used as immediate. Mark every immediate operand as such to avoid this problem. Cc: stable@vger.kernel.org Fixes: Signed-off-by:

Nadav Amit <namit@cs.technion.ac.il> Signed-off-by:

Paolo Bonzini <pbonzini@redhat.com>

arch/x86/kvm/emulate.c

+8 −0

Original line number	Diff line number	Diff line
		@@ -4287,6 +4287,7 @@ static int decode_operand(struct x86_emulate_ctxt ctxt, struct operand op,
		fetch_register_operand(op);
		break;
		case OpCL:
		op->type = OP_IMM;
		op->bytes = 1;
		op->val = reg_read(ctxt, VCPU_REGS_RCX) & 0xff;
		break;
		@@ -4294,6 +4295,7 @@ static int decode_operand(struct x86_emulate_ctxt ctxt, struct operand op,
		rc = decode_imm(ctxt, op, 1, true);
		break;
		case OpOne:
		op->type = OP_IMM;
		op->bytes = 1;
		op->val = 1;
		break;
		@@ -4352,21 +4354,27 @@ static int decode_operand(struct x86_emulate_ctxt ctxt, struct operand op,
		ctxt->memop.bytes = ctxt->op_bytes + 2;
		goto mem_common;
		case OpES:
		op->type = OP_IMM;
		op->val = VCPU_SREG_ES;
		break;
		case OpCS:
		op->type = OP_IMM;
		op->val = VCPU_SREG_CS;
		break;
		case OpSS:
		op->type = OP_IMM;
		op->val = VCPU_SREG_SS;
		break;
		case OpDS:
		op->type = OP_IMM;
		op->val = VCPU_SREG_DS;
		break;
		case OpFS:
		op->type = OP_IMM;
		op->val = VCPU_SREG_FS;
		break;
		case OpGS:
		op->type = OP_IMM;
		op->val = VCPU_SREG_GS;
		break;
		case OpImplicit:

Admin message