diff mbox

KVM: x86 emulator: Fix unconditional return from get_descriptor_table_ptr()

Message ID 20110521130639.d4615ee1.takuya.yoshikawa@gmail.com (mailing list archive)
State New, archived
Headers show

Commit Message

Takuya Yoshikawa May 21, 2011, 4:06 a.m. UTC 
From: Takuya Yoshikawa <yoshikawa.takuya@oss.ntt.co.jp>

A trivial typo was found in the following commit:
  commit 7753ed6043bfce55dc0c407490896632014b677e
  KVM: x86 emulator: drop vcpu argument from segment/gdt/idt callbacks

When the table indicator flag is set, when the selector selects the
current LDT, get_descriptor_table_ptr() returns without setting the
size and address of the table.

Guests will see #GP if this happens.

Signed-off-by: Takuya Yoshikawa <yoshikawa.takuya@oss.ntt.co.jp>
---
 Is this stable material? -- IIRC, someone reported a suspicous
 emulator bug recently.

 arch/x86/kvm/emulate.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

Comments

Avi Kivity May 22, 2011, 12:57 p.m. UTC | #1 
On 05/21/2011 07:06 AM, Takuya Yoshikawa wrote:
> From: Takuya Yoshikawa<yoshikawa.takuya@oss.ntt.co.jp>
>
> A trivial typo was found in the following commit:
>    commit 7753ed6043bfce55dc0c407490896632014b677e
>    KVM: x86 emulator: drop vcpu argument from segment/gdt/idt callbacks
>
> When the table indicator flag is set, when the selector selects the
> current LDT, get_descriptor_table_ptr() returns without setting the
> size and address of the table.
>
> Guests will see #GP if this happens.
>

Thanks, applied.

> Signed-off-by: Takuya Yoshikawa<yoshikawa.takuya@oss.ntt.co.jp>
> ---
>   Is this stable material? -- IIRC, someone reported a suspicous
>   emulator bug recently.

This was not yet merged upstream, so I folded this into the bad commit, 
and upstream will never see the bug.  It's now 4bff1e86ad286d in kvm.git.
diff mbox

Patch

diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c
index 3bc6b7a..b8b9748 100644
--- a/arch/x86/kvm/emulate.c
+++ b/arch/x86/kvm/emulate.c
@@ -1158,7 +1158,7 @@  static void get_descriptor_table_ptr(struct x86_emulate_ctxt *ctxt,
 		u16 sel;
 
 		memset (dt, 0, sizeof *dt);
-		if (!ops->get_segment(ctxt, &sel, &desc, NULL, VCPU_SREG_LDTR));
+		if (!ops->get_segment(ctxt, &sel, &desc, NULL, VCPU_SREG_LDTR))
 			return;
 
 		dt->size = desc_limit_scaled(&desc); /* what if limit > 65535? */