[PATCH v1 0/2] accel/tcg: fix crash on instruction straddling address-space end

[Tao Cui <cui.tao@linux.dev>]

From: Tao Cui <cuitao@kylinos.cn>

translator_ld() asserts that a page-crossing instruction reads its two
pages from virtually-contiguous addresses (page0 + TARGET_PAGE_SIZE). On
32-bit targets a guest can defeat this by executing an instruction at
the very end of the address space, which wraps the second page back to
the start; the assert fires and QEMU aborts. This is a guest-triggered
host crash (DoS).

Patch 1 takes the second page from pc when the linear page0 +
TARGET_PAGE_SIZE does not land on pc's page, handling both the normal
contiguous case and the wraparound case without needing the
address-space width.

Patch 2 adds a multiboot regression test (tests/multiboot/wraparound)
that runs on qemu-system-i386 and aborts without the fix.

Tao Cui (2):
  accel/tcg: fix crash on instruction straddling address-space end
  tests/multiboot: add regression test for translator_ld wraparound

 accel/tcg/translator.c         | 16 ++++++------
 tests/multiboot/Makefile       |  7 +++++-
 tests/multiboot/run_test.sh    |  8 +++++-
 tests/multiboot/wraparound.c   | 46 ++++++++++++++++++++++++++++++++++
 tests/multiboot/wraparound.out |  5 ++++
 5 files changed, 72 insertions(+), 10 deletions(-)
 create mode 100644 tests/multiboot/wraparound.c
 create mode 100644 tests/multiboot/wraparound.out

-- 
2.43.0