| From 08da44aedba0f493e10695fa334348a7a4f72eb3 Mon Sep 17 00:00:00 2001 |
| From: Nadav Amit <namit@cs.technion.ac.il> |
| Date: Fri, 3 Oct 2014 01:10:04 +0300 |
| Subject: KVM: x86: Decoding guest instructions which cross page boundary may fail |
| |
| From: Nadav Amit <namit@cs.technion.ac.il> |
| |
| commit 08da44aedba0f493e10695fa334348a7a4f72eb3 upstream. |
| |
| Once an instruction crosses a page boundary, the size read from the second page |
| disregards the common case that part of the operand resides on the first page. |
| As a result, fetch of long insturctions may fail, and thereby cause the |
| decoding to fail as well. |
| |
| Fixes: 5cfc7e0f5e5e1adf998df94f8e36edaf5d30d38e |
| Signed-off-by: Nadav Amit <namit@cs.technion.ac.il> |
| Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| |
| --- |
| arch/x86/kvm/emulate.c | 6 ++++-- |
| 1 file changed, 4 insertions(+), 2 deletions(-) |
| |
| --- a/arch/x86/kvm/emulate.c |
| +++ b/arch/x86/kvm/emulate.c |
| @@ -773,8 +773,10 @@ static int __do_insn_fetch_bytes(struct |
| static __always_inline int do_insn_fetch_bytes(struct x86_emulate_ctxt *ctxt, |
| unsigned size) |
| { |
| - if (unlikely(ctxt->fetch.end - ctxt->fetch.ptr < size)) |
| - return __do_insn_fetch_bytes(ctxt, size); |
| + unsigned done_size = ctxt->fetch.end - ctxt->fetch.ptr; |
| + |
| + if (unlikely(done_size < size)) |
| + return __do_insn_fetch_bytes(ctxt, size - done_size); |
| else |
| return X86EMUL_CONTINUE; |
| } |
