From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:49859) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1YJN1f-0001SX-Tq for qemu-devel@nongnu.org; Thu, 05 Feb 2015 09:03:24 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1YJN1e-0007X2-G5 for qemu-devel@nongnu.org; Thu, 05 Feb 2015 09:03:23 -0500 Received: from mnementh.archaic.org.uk ([2001:8b0:1d0::1]:54955) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1YJN1e-0007RD-9Y for qemu-devel@nongnu.org; Thu, 05 Feb 2015 09:03:22 -0500 Received: from pm215 by mnementh.archaic.org.uk with local (Exim 4.80) (envelope-from ) id 1YJN1P-0002zc-Tz for qemu-devel@nongnu.org; Thu, 05 Feb 2015 14:03:07 +0000 From: Peter Maydell Date: Thu, 5 Feb 2015 14:02:50 +0000 Message-Id: <1423144987-11425-12-git-send-email-peter.maydell@linaro.org> In-Reply-To: <1423144987-11425-1-git-send-email-peter.maydell@linaro.org> References: <1423144987-11425-1-git-send-email-peter.maydell@linaro.org> Subject: [Qemu-devel] [PULL 11/28] target-arm: check that LSB <= MSB in BFI instruction List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org From: Kirill Batuzov The documentation states that if LSB > MSB in BFI instruction behaviour is unpredictable. Currently QEMU crashes because of assertion failure in this case: tcg/tcg-op.h:2061: tcg_gen_deposit_i32: Assertion `len <= 32' failed. While assertion failure may meet the "unpredictable" definition this behaviour is undesirable because it allows an unprivileged guest program to crash the emulator with the OS and other programs. This patch addresses the issue by throwing illegal instruction exception if LSB > MSB. Only ARM decoder is affected because Thumb decoder already has this check in place. To reproduce issue run the following program int main(void) { asm volatile (".long 0x07c00c12" :: ); return 0; } compiled with gcc -marm -static badop_arm.c -o badop_arm Signed-off-by: Kirill Batuzov Signed-off-by: Peter Maydell --- target-arm/translate.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/target-arm/translate.c b/target-arm/translate.c index bdfcdf1..2c1c2a7 100644 --- a/target-arm/translate.c +++ b/target-arm/translate.c @@ -8739,6 +8739,10 @@ static void disas_arm_insn(DisasContext *s, unsigned int insn) ARCH(6T2); shift = (insn >> 7) & 0x1f; i = (insn >> 16) & 0x1f; + if (i < shift) { + /* UNPREDICTABLE; we choose to UNDEF */ + goto illegal_op; + } i = i + 1 - shift; if (rm == 15) { tmp = tcg_temp_new_i32(); -- 1.9.1