KVM: x86: Fix uninitialized op->type for some immediate values
The emulator could reuse an op->type from a previous instruction for some
immediate values. If it mistakenly considers the operands as memory
operands, it will performs a memory read and overwrite op->val.
Consider for instance the ROR instruction - src2 (the number of times)
would be read from memory instead of being used as immediate.
Mark every immediate operand as such to avoid this problem.
Cc: stable@vger.kernel.org
Fixes: c44b4c6ab8
Signed-off-by: Nadav Amit <namit@cs.technion.ac.il>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
This commit is contained in:
parent
bc79a3179a
commit
d29b9d7ed7
1 changed files with 8 additions and 0 deletions
|
@ -4287,6 +4287,7 @@ static int decode_operand(struct x86_emulate_ctxt *ctxt, struct operand *op,
|
|||
fetch_register_operand(op);
|
||||
break;
|
||||
case OpCL:
|
||||
op->type = OP_IMM;
|
||||
op->bytes = 1;
|
||||
op->val = reg_read(ctxt, VCPU_REGS_RCX) & 0xff;
|
||||
break;
|
||||
|
@ -4294,6 +4295,7 @@ static int decode_operand(struct x86_emulate_ctxt *ctxt, struct operand *op,
|
|||
rc = decode_imm(ctxt, op, 1, true);
|
||||
break;
|
||||
case OpOne:
|
||||
op->type = OP_IMM;
|
||||
op->bytes = 1;
|
||||
op->val = 1;
|
||||
break;
|
||||
|
@ -4352,21 +4354,27 @@ static int decode_operand(struct x86_emulate_ctxt *ctxt, struct operand *op,
|
|||
ctxt->memop.bytes = ctxt->op_bytes + 2;
|
||||
goto mem_common;
|
||||
case OpES:
|
||||
op->type = OP_IMM;
|
||||
op->val = VCPU_SREG_ES;
|
||||
break;
|
||||
case OpCS:
|
||||
op->type = OP_IMM;
|
||||
op->val = VCPU_SREG_CS;
|
||||
break;
|
||||
case OpSS:
|
||||
op->type = OP_IMM;
|
||||
op->val = VCPU_SREG_SS;
|
||||
break;
|
||||
case OpDS:
|
||||
op->type = OP_IMM;
|
||||
op->val = VCPU_SREG_DS;
|
||||
break;
|
||||
case OpFS:
|
||||
op->type = OP_IMM;
|
||||
op->val = VCPU_SREG_FS;
|
||||
break;
|
||||
case OpGS:
|
||||
op->type = OP_IMM;
|
||||
op->val = VCPU_SREG_GS;
|
||||
break;
|
||||
case OpImplicit:
|
||||
|
|
Loading…
Reference in a new issue