Re: [Qemu-devel] [BUG] user-to-root privesc inside VM via bad translation caching

[Richard Henderson <rth@twiddle.net>]

On 03/23/2017 02:29 AM, Pranith Kumar wrote:
> On Wed, Mar 22, 2017 at 11:21 AM, Peter Maydell
> <peter.maydell@linaro.org> wrote:
>> On 22 March 2017 at 15:14, Pranith Kumar <bobby.prani+qemu@gmail.com> wrote:
>>> On Wed, Mar 22, 2017 at 11:04 AM, Peter Maydell
>>> <peter.maydell@linaro.org> wrote:
>>>> This doesn't look right because it means we'll check
>>>> only after we've emitted all the code to do the
>>>> instruction operation, so the effect will be
>>>> "execute instruction, then take illegal-opcode
>>>> exception".
>>
>>> The pc is restored to original address (s->pc = pc_start), so the
>>> exception will overwrite the generated illegal instruction and will be
>>> executed first.
>>
>> s->pc is the guest PC -- moving that backwards will
>> not do anything about the generated TCG IR that's
>> already been written. You'd need to rewind the
>> write pointer in the IR stream, which there is
>> no support for doing AFAIK.
>
> Ah, OK. Thanks for the explanation. May be we should check the size of
> the instruction while decoding the prefixes and error out once we
> exceed the limit. We would not generate any IR code.

Yes.

It would not enforce a true limit of 15 bytes, since you can't know that until 
you've done the rest of the decode.  But you'd be able to say that no more than 
14 prefix + 1 opc + 6 modrm+sib+ofs + 4 immediate = 25 bytes is used.

Which does fix the bug.


r~