Commit 7818ad4c authored by Nadav Amit's avatar Nadav Amit Committed by Luis Henriques

KVM: x86: Fix uninitialized op->type for some immediate values

commit d29b9d7e upstream.

The emulator could reuse an op->type from a previous instruction for some
immediate values.  If it mistakenly considers the operands as memory
operands, it will performs a memory read and overwrite op->val.

Consider for instance the ROR instruction - src2 (the number of times)
would be read from memory instead of being used as immediate.

Mark every immediate operand as such to avoid this problem.

Fixes: c44b4c6aSigned-off-by: default avatarNadav Amit <namit@cs.technion.ac.il>
Signed-off-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
Signed-off-by: default avatarLuis Henriques <luis.henriques@canonical.com>
parent 67d30efb
......@@ -4220,6 +4220,7 @@ static int decode_operand(struct x86_emulate_ctxt *ctxt, struct operand *op,
fetch_register_operand(op);
break;
case OpCL:
op->type = OP_IMM;
op->bytes = 1;
op->val = reg_read(ctxt, VCPU_REGS_RCX) & 0xff;
break;
......@@ -4227,6 +4228,7 @@ static int decode_operand(struct x86_emulate_ctxt *ctxt, struct operand *op,
rc = decode_imm(ctxt, op, 1, true);
break;
case OpOne:
op->type = OP_IMM;
op->bytes = 1;
op->val = 1;
break;
......@@ -4285,21 +4287,27 @@ static int decode_operand(struct x86_emulate_ctxt *ctxt, struct operand *op,
ctxt->memop.bytes = ctxt->op_bytes + 2;
goto mem_common;
case OpES:
op->type = OP_IMM;
op->val = VCPU_SREG_ES;
break;
case OpCS:
op->type = OP_IMM;
op->val = VCPU_SREG_CS;
break;
case OpSS:
op->type = OP_IMM;
op->val = VCPU_SREG_SS;
break;
case OpDS:
op->type = OP_IMM;
op->val = VCPU_SREG_DS;
break;
case OpFS:
op->type = OP_IMM;
op->val = VCPU_SREG_FS;
break;
case OpGS:
op->type = OP_IMM;
op->val = VCPU_SREG_GS;
break;
case OpImplicit:
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment