Commit 08da44ae authored Oct 03, 2014 by Nadav Amit Committed by Paolo Bonzini Oct 24, 2014

KVM: x86: Decoding guest instructions which cross page boundary may fail



Once an instruction crosses a page boundary, the size read from the second page
disregards the common case that part of the operand resides on the first page.
As a result, fetch of long insturctions may fail, and thereby cause the
decoding to fail as well.

Cc: stable@vger.kernel.org
Fixes: 5cfc7e0f
Signed-off-by: Nadav Amit <namit@cs.technion.ac.il>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

parent 2bc19dc3

arch/x86/kvm/emulate.c

+4 −2

Original line number	Diff line number	Diff line
		@@ -778,8 +778,10 @@ static int __do_insn_fetch_bytes(struct x86_emulate_ctxt *ctxt, int op_size)
		static __always_inline int do_insn_fetch_bytes(struct x86_emulate_ctxt *ctxt,
		unsigned size)
		{
		if (unlikely(ctxt->fetch.end - ctxt->fetch.ptr < size))
		return __do_insn_fetch_bytes(ctxt, size);
		unsigned done_size = ctxt->fetch.end - ctxt->fetch.ptr;

		if (unlikely(done_size < size))
		return __do_insn_fetch_bytes(ctxt, size - done_size);
		else
		return X86EMUL_CONTINUE;
		}