[PATCH v1 1/2] accel/tcg: fix crash on instruction straddling address-space end

[Tao Cui <cui.tao@linux.dev>]

From: Tao Cui <cuitao@kylinos.cn>

translator_ld() reads the bytes of a page-crossing instruction into a
contiguous buffer. When computing the second page address it assumes the
two pages are virtually contiguous (second = page0 + TARGET_PAGE_SIZE)
and asserts that the read pointer pc is on that page.

On targets whose address space is narrower than vaddr (the 32-bit
targets, e.g. i386 or ARM AArch32 Thumb), an instruction at the very end
of the address space wraps the second page back to the start of the
address space. The target advances its fetch PC as a target_ulong, so pc
wraps to 0, while the linear page0 + TARGET_PAGE_SIZE stays at
0x1_0000_0000; the assert fails and QEMU aborts. A guest can trigger this
by mapping the last page executable and running a straddling instruction,
i.e. a guest-triggered host crash (DoS).

Instead of asserting, take the second page from pc: if the linear
page0 + TARGET_PAGE_SIZE does not land on pc's page, use pc's page. This
is correct for both the normal contiguous case and the wraparound case,
without needing to know the address-space width.

Tested with a minimal i386 multiboot payload that executes an instruction
at 0xfffffffe: before this change QEMU aborts (translator.c:296), after it
translates and runs normally.

Signed-off-by: Tao Cui <cuitao@kylinos.cn>
---
 accel/tcg/translator.c | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/accel/tcg/translator.c b/accel/tcg/translator.c
index cd7d079fe0..750c132bbc 100644
--- a/accel/tcg/translator.c
+++ b/accel/tcg/translator.c
@@ -283,16 +283,16 @@ static bool translator_ld(CPUArchState *env, DisasContextBase *db,
     }
 
     /*
-     * The read must conclude on the second page and not extend to a third.
-     *
-     * TODO: We could allow the two pages to be virtually discontiguous,
-     * since we already allow the two pages to be physically discontiguous.
-     * The only reasonable use case would be executing an insn at the end
-     * of the address space wrapping around to the beginning.  For that,
-     * we would need to know the current width of the address space.
-     * In the meantime, assert.
+     * The read must conclude on the second page and must not extend to a
+     * third.  An instruction that straddles the end of the address space
+     * wraps the second page back to the start of the address space, so the
+     * linear page0 + TARGET_PAGE_SIZE does not land on pc's page; in that
+     * case take the second page from pc instead of asserting.
      */
     base = (base & TARGET_PAGE_MASK) + TARGET_PAGE_SIZE;
+    if (((base ^ pc) & TARGET_PAGE_MASK) != 0) {
+        base = pc & TARGET_PAGE_MASK;
+    }
     assert(((base ^ pc) & TARGET_PAGE_MASK) == 0);
     assert(((base ^ last) & TARGET_PAGE_MASK) == 0);
     host = db->host_addr[1];
-- 
2.43.0