From patchwork Thu Mar 23 16:50:10 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Pranith Kumar X-Patchwork-Id: 9641605 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 4F140602CA for ; Thu, 23 Mar 2017 16:51:20 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 431C721E5A for ; Thu, 23 Mar 2017 16:51:20 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 37E9B283FD; Thu, 23 Mar 2017 16:51:20 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=2.0 tests=BAYES_00, DKIM_ADSP_CUSTOM_MED, DKIM_SIGNED, FREEMAIL_FROM, RCVD_IN_DNSWL_HI, T_DKIM_INVALID autolearn=ham version=3.3.1 Received: from lists.gnu.org (lists.gnu.org [208.118.235.17]) (using TLSv1 with cipher AES256-SHA (256/256 bits)) (No client certificate requested) by mail.wl.linuxfoundation.org (Postfix) with ESMTPS id D7E8727F90 for ; Thu, 23 Mar 2017 16:51:19 +0000 (UTC) Received: from localhost ([::1]:57478 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1cr5xH-0007U5-1T for patchwork-qemu-devel@patchwork.kernel.org; Thu, 23 Mar 2017 12:51:19 -0400 Received: from eggs.gnu.org ([2001:4830:134:3::10]:39776) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1cr5wh-0007Rs-4u for qemu-devel@nongnu.org; Thu, 23 Mar 2017 12:50:44 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1cr5wg-0001h0-9A for qemu-devel@nongnu.org; Thu, 23 Mar 2017 12:50:43 -0400 Received: from mail-yw0-x242.google.com ([2607:f8b0:4002:c05::242]:33218) by eggs.gnu.org with esmtps (TLS1.0:RSA_AES_128_CBC_SHA1:16) (Exim 4.71) (envelope-from ) id 1cr5wg-0001gq-4p for qemu-devel@nongnu.org; Thu, 23 Mar 2017 12:50:42 -0400 Received: by mail-yw0-x242.google.com with SMTP id p77so24205524ywg.0 for ; Thu, 23 Mar 2017 09:50:41 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:sender:in-reply-to:references:from:date:message-id :subject:to:cc; bh=SNQsUUtpUFL8n+OjckVbBX8Zn4lEXUpIrjV7w+8I618=; b=jCReQGlegtvTaMZLSEFN3RagBWG/wAvvtlUmz8yPmfCfc8jBcBG+cfbYckxWMhfoxq myWUiIctaoZzcDkkSjJKAGbC9QRVPv8SWrhdPnzdOQ6zHfYOnvVfWkArfwmmymURmfHV XxugHHbaJH+iL6BhvpvkD8i+KSFSqdCEBtVODidekHtN6WcmaSVLCsEHTAZf9w+AK4Og rdm6K5iW74bOZIFUFLLePCe9SGv/ZuiVE/a5h5nkQNnzw2gLQqoJ8p6U+6qfWdRWW53U QnX0f0kwvhwsD4QM6uiyn4y8qdcnsPZGZxTq22MgF5+Hm8/n0Ubyt9NBWjF775NYHyQq Qu8w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:sender:in-reply-to:references:from :date:message-id:subject:to:cc; bh=SNQsUUtpUFL8n+OjckVbBX8Zn4lEXUpIrjV7w+8I618=; b=NTSUDMrl3eg247TQkWz4PWLUKKl7Hrd/O/ni7oL2DF/XbB5VHltAKHMqAGsXmZid5W 2bOUqKOtnk7Ppztptoi6a3+Y0UprInO5u1G9Iyi3n54PD7FnZ2hyUvrEP8ThCSNJK0Yv JTj17EPnuMLHGfppcr9quBYHbPha+2/9KNLp4wWBPpqQTtAdnow82ddKqqXe5xLBTU4j 1YsD04d28FDl/GS1hmrQpvlnNNeco/WYeulBUUGmCbjWT2lBgCtq+rL6RWqfy1alG6Fh QvsqJC8A9soHly6TWEyQY11vpLxfSvQIGUK+/T/vGvKeqrmvsy9N+qWM64ZCIvxMUQYl OYKw== X-Gm-Message-State: AFeK/H1vH6cn4ahXJdW3aNt46IqDDu1182R2RWoAlleoWr7M0xuNtrwp9WrKsF+Ym/5M84wmkR3hAcH43egRVw== X-Received: by 10.129.183.18 with SMTP id v18mr2356946ywh.217.1490287841158; Thu, 23 Mar 2017 09:50:41 -0700 (PDT) MIME-Version: 1.0 Received: by 10.129.52.75 with HTTP; Thu, 23 Mar 2017 09:50:10 -0700 (PDT) In-Reply-To: References: <9f45e912-5fc8-bb99-506e-221f2cb6ac7e@twiddle.net> From: Pranith Kumar Date: Thu, 23 Mar 2017 12:50:10 -0400 X-Google-Sender-Auth: NgjkeL3_X42wLIe1nosR1yZq2YU Message-ID: To: Paolo Bonzini X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] X-Received-From: 2607:f8b0:4002:c05::242 Subject: Re: [Qemu-devel] [BUG] user-to-root privesc inside VM via bad translation caching X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Peter Maydell , Jann Horn , Qemu Developers , Richard Henderson Errors-To: qemu-devel-bounces+patchwork-qemu-devel=patchwork.kernel.org@nongnu.org Sender: "Qemu-devel" X-Virus-Scanned: ClamAV using ClamSMTP On Thu, Mar 23, 2017 at 6:27 AM, Paolo Bonzini wrote: > > > On 22/03/2017 21:01, Richard Henderson wrote: >>> >>> Ah, OK. Thanks for the explanation. May be we should check the size of >>> the instruction while decoding the prefixes and error out once we >>> exceed the limit. We would not generate any IR code. >> >> Yes. >> >> It would not enforce a true limit of 15 bytes, since you can't know that >> until you've done the rest of the decode. But you'd be able to say that >> no more than 14 prefix + 1 opc + 6 modrm+sib+ofs + 4 immediate = 25 >> bytes is used. >> >> Which does fix the bug. > > Yeah, that would work for 2.9 if somebody wants to put together a patch. > Ensuring that all instruction fetching happens before translation side > effects is a little harder, but perhaps it's also the opportunity to get > rid of s->rip_offset which is a little ugly. How about the following? /* Collect prefixes. */ --- Pranith diff --git a/target/i386/translate.c b/target/i386/translate.c index 72c1b03a2a..67c58b8900 100644 --- a/target/i386/translate.c +++ b/target/i386/translate.c @@ -4418,6 +4418,11 @@ static target_ulong disas_insn(CPUX86State *env, DisasContext *s, s->vex_l = 0; s->vex_v = 0; next_byte: + /* The prefixes can atmost be 14 bytes since x86 has an upper + limit of 15 bytes for the instruction */ + if (s->pc - pc_start > 14) { + goto illegal_op; + } b = cpu_ldub_code(env, s->pc); s->pc++;