diff options
| author | Stanislav Shmarov <snarpix@gmail.com> | 2016-09-13 16:23:28 +0300 |
|---|---|---|
| committer | Paolo Bonzini <pbonzini@redhat.com> | 2016-09-14 22:52:44 +0200 |
| commit | 885b7c44e4f8b7a012a92770a0dba8b238662caa (patch) | |
| tree | 8cea4b3ec7b87c187b7c31322d749e493299b713 | |
| parent | 89d0a64f496fb4248885ebf75216c49337951540 (diff) | |
| download | qemu-885b7c44e4f8b7a012a92770a0dba8b238662caa.tar.gz qemu-885b7c44e4f8b7a012a92770a0dba8b238662caa.tar.bz2 qemu-885b7c44e4f8b7a012a92770a0dba8b238662caa.zip | |
target-i386: Fixed syscall posssible segfault
In user-mode emulation env->idt.base memory is
allocated in linux-user/main.c with
size 8*512 = 4096 (for 64-bit).
When fake interrupt EXCP_SYSCALL is thrown
do_interrupt_user checks destination privilege level
for this fake exception, and tries to read 4 bytes
at address base + (256 * 2^4)=4096, that causes
segfault.
Privlege level was checked only for int's, so lets
read dpl from memory only for this case.
Signed-off-by: Stanislav Shmarov <snarpix@gmail.com>
Message-Id: <1473773008-2588376-1-git-send-email-snarpix@gmail.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
| -rw-r--r-- | target-i386/seg_helper.c | 36 |
1 files changed, 19 insertions, 17 deletions
diff --git a/target-i386/seg_helper.c b/target-i386/seg_helper.c index 6cbdf17426..fb79f3180d 100644 --- a/target-i386/seg_helper.c +++ b/target-i386/seg_helper.c @@ -1137,25 +1137,27 @@ static void do_interrupt_real(CPUX86State *env, int intno, int is_int, static void do_interrupt_user(CPUX86State *env, int intno, int is_int, int error_code, target_ulong next_eip) { - SegmentCache *dt; - target_ulong ptr; - int dpl, cpl, shift; - uint32_t e2; + if (is_int) { + SegmentCache *dt; + target_ulong ptr; + int dpl, cpl, shift; + uint32_t e2; - dt = &env->idt; - if (env->hflags & HF_LMA_MASK) { - shift = 4; - } else { - shift = 3; - } - ptr = dt->base + (intno << shift); - e2 = cpu_ldl_kernel(env, ptr + 4); + dt = &env->idt; + if (env->hflags & HF_LMA_MASK) { + shift = 4; + } else { + shift = 3; + } + ptr = dt->base + (intno << shift); + e2 = cpu_ldl_kernel(env, ptr + 4); - dpl = (e2 >> DESC_DPL_SHIFT) & 3; - cpl = env->hflags & HF_CPL_MASK; - /* check privilege if software int */ - if (is_int && dpl < cpl) { - raise_exception_err(env, EXCP0D_GPF, (intno << shift) + 2); + dpl = (e2 >> DESC_DPL_SHIFT) & 3; + cpl = env->hflags & HF_CPL_MASK; + /* check privilege if software int */ + if (dpl < cpl) { + raise_exception_err(env, EXCP0D_GPF, (intno << shift) + 2); + } } /* Since we emulate only user space, we cannot do more than |