| Message ID | 1473773008-2588376-1-git-send-email-snarpix@gmail.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
On 13/09/2016 15:23, Stanislav Shmarov wrote: > In user-mode emulation env->idt.base memory is > allocated in linux-user/main.c with > size 8*512 = 4096 (for 64-bit). > When fake interrupt EXCP_SYSCALL is thrown > do_interrupt_user checks destination privilege level > for this fake exception, and tries to read 4 bytes > at address base + (256 * 2^4)=4096, that causes > segfault. > > Privlege level was checked only for int's, so lets > read dpl from memory only for this case. > > Signed-off-by: Stanislav Shmarov <snarpix@gmail.com> Queued for 2.8, thanks. Paolo > --- > target-i386/seg_helper.c | 36 +++++++++++++++++++----------------- > 1 file changed, 19 insertions(+), 17 deletions(-) > > diff --git a/target-i386/seg_helper.c b/target-i386/seg_helper.c > index 6cbdf17..fb79f31 100644 > --- a/target-i386/seg_helper.c > +++ b/target-i386/seg_helper.c > @@ -1137,25 +1137,27 @@ static void do_interrupt_real(CPUX86State *env, int intno, int is_int, > static void do_interrupt_user(CPUX86State *env, int intno, int is_int, > int error_code, target_ulong next_eip) > { > - SegmentCache *dt; > - target_ulong ptr; > - int dpl, cpl, shift; > - uint32_t e2; > + if (is_int) { > + SegmentCache *dt; > + target_ulong ptr; > + int dpl, cpl, shift; > + uint32_t e2; > > - dt = &env->idt; > - if (env->hflags & HF_LMA_MASK) { > - shift = 4; > - } else { > - shift = 3; > - } > - ptr = dt->base + (intno << shift); > - e2 = cpu_ldl_kernel(env, ptr + 4); > + dt = &env->idt; > + if (env->hflags & HF_LMA_MASK) { > + shift = 4; > + } else { > + shift = 3; > + } > + ptr = dt->base + (intno << shift); > + e2 = cpu_ldl_kernel(env, ptr + 4); > > - dpl = (e2 >> DESC_DPL_SHIFT) & 3; > - cpl = env->hflags & HF_CPL_MASK; > - /* check privilege if software int */ > - if (is_int && dpl < cpl) { > - raise_exception_err(env, EXCP0D_GPF, (intno << shift) + 2); > + dpl = (e2 >> DESC_DPL_SHIFT) & 3; > + cpl = env->hflags & HF_CPL_MASK; > + /* check privilege if software int */ > + if (dpl < cpl) { > + raise_exception_err(env, EXCP0D_GPF, (intno << shift) + 2); > + } > } > > /* Since we emulate only user space, we cannot do more than >
diff --git a/target-i386/seg_helper.c b/target-i386/seg_helper.c index 6cbdf17..fb79f31 100644 --- a/target-i386/seg_helper.c +++ b/target-i386/seg_helper.c @@ -1137,25 +1137,27 @@ static void do_interrupt_real(CPUX86State *env, int intno, int is_int, static void do_interrupt_user(CPUX86State *env, int intno, int is_int, int error_code, target_ulong next_eip) { - SegmentCache *dt; - target_ulong ptr; - int dpl, cpl, shift; - uint32_t e2; + if (is_int) { + SegmentCache *dt; + target_ulong ptr; + int dpl, cpl, shift; + uint32_t e2; - dt = &env->idt; - if (env->hflags & HF_LMA_MASK) { - shift = 4; - } else { - shift = 3; - } - ptr = dt->base + (intno << shift); - e2 = cpu_ldl_kernel(env, ptr + 4); + dt = &env->idt; + if (env->hflags & HF_LMA_MASK) { + shift = 4; + } else { + shift = 3; + } + ptr = dt->base + (intno << shift); + e2 = cpu_ldl_kernel(env, ptr + 4); - dpl = (e2 >> DESC_DPL_SHIFT) & 3; - cpl = env->hflags & HF_CPL_MASK; - /* check privilege if software int */ - if (is_int && dpl < cpl) { - raise_exception_err(env, EXCP0D_GPF, (intno << shift) + 2); + dpl = (e2 >> DESC_DPL_SHIFT) & 3; + cpl = env->hflags & HF_CPL_MASK; + /* check privilege if software int */ + if (dpl < cpl) { + raise_exception_err(env, EXCP0D_GPF, (intno << shift) + 2); + } } /* Since we emulate only user space, we cannot do more than
In user-mode emulation env->idt.base memory is allocated in linux-user/main.c with size 8*512 = 4096 (for 64-bit). When fake interrupt EXCP_SYSCALL is thrown do_interrupt_user checks destination privilege level for this fake exception, and tries to read 4 bytes at address base + (256 * 2^4)=4096, that causes segfault. Privlege level was checked only for int's, so lets read dpl from memory only for this case. Signed-off-by: Stanislav Shmarov <snarpix@gmail.com> --- target-i386/seg_helper.c | 36 +++++++++++++++++++----------------- 1 file changed, 19 insertions(+), 17 deletions(-)