Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit d29b9d7e authored by Nadav Amit's avatar Nadav Amit Committed by Paolo Bonzini
Browse files

KVM: x86: Fix uninitialized op->type for some immediate values 



The emulator could reuse an op->type from a previous instruction for some
immediate values.  If it mistakenly considers the operands as memory
operands, it will performs a memory read and overwrite op->val.

Consider for instance the ROR instruction - src2 (the number of times)
would be read from memory instead of being used as immediate.

Mark every immediate operand as such to avoid this problem.

Cc: stable@vger.kernel.org
Fixes: c44b4c6a
Signed-off-by: default avatarNadav Amit <namit@cs.technion.ac.il>
Signed-off-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
parent bc79a317

arch/x86/kvm/emulate.c

+8 −0
Original line number Diff line number Diff line
@@ -4287,6 +4287,7 @@ static int decode_operand(struct x86_emulate_ctxt *ctxt, struct operand *op, 
		fetch_register_operand(op);

		break;

	case OpCL:

		op->type = OP_IMM;

		op->bytes = 1;

		op->val = reg_read(ctxt, VCPU_REGS_RCX) & 0xff;

		break;
@@ -4294,6 +4295,7 @@ static int decode_operand(struct x86_emulate_ctxt *ctxt, struct operand *op, 
		rc = decode_imm(ctxt, op, 1, true);

		break;

	case OpOne:

		op->type = OP_IMM;

		op->bytes = 1;

		op->val = 1;

		break;
@@ -4352,21 +4354,27 @@ static int decode_operand(struct x86_emulate_ctxt *ctxt, struct operand *op, 
		ctxt->memop.bytes = ctxt->op_bytes + 2;

		goto mem_common;

	case OpES:

		op->type = OP_IMM;

		op->val = VCPU_SREG_ES;

		break;

	case OpCS:

		op->type = OP_IMM;

		op->val = VCPU_SREG_CS;

		break;

	case OpSS:

		op->type = OP_IMM;

		op->val = VCPU_SREG_SS;

		break;

	case OpDS:

		op->type = OP_IMM;

		op->val = VCPU_SREG_DS;

		break;

	case OpFS:

		op->type = OP_IMM;

		op->val = VCPU_SREG_FS;

		break;

	case OpGS:

		op->type = OP_IMM;

		op->val = VCPU_SREG_GS;

		break;

	case OpImplicit: