From c8cf86becc57da722dcd62c1aef21d163a3dd1a9 Mon Sep 17 00:00:00 2001 From: Eduardo Habkost <ehabkost@redhat.com> Date: Fri, 16 Oct 2009 16:24:38 -0300 Subject: [PATCH] kvm: fix kvm_arch_save_regs() potential stack corruption RH-Author: Eduardo Habkost <ehabkost@redhat.com> Message-id: <20091014184927.GS24126@blackpad.lan.raisama.net> Patchwork-id: 3592 O-Subject: [RHEL-5.5 KVM PATCH] kvm: fix kvm_arch_save_regs() potential stack corruption Bugzilla: 528917 RH-Acked-by: Markus Armbruster <armbru@redhat.com> RH-Acked-by: Marcelo Tosatti <mtosatti@redhat.com> RH-Acked-by: Juan Quintela <quintela@redhat.com> Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=528917 A new register was added to the load/save list on commit d283d5a65a2bdcc570065267be21848bd6fe3d78, but MSR_COUNT was not updated, leading to potential stack corruption on kvm_arch_save_regs(). The following registers are saved by kvm_arch_save_regs(): 1) MSR_IA32_SYSENTER_CS 2) MSR_IA32_SYSENTER_ESP 3) MSR_IA32_SYSENTER_EIP 4) MSR_STAR 5) MSR_IA32_TSC 6) MSR_VM_HSAVE_PA 7) MSR_CSTAR (x86_64 only) 8) MSR_KERNELGSBASE (x86_64 only) 9) MSR_FMASK (x86_64 only) 10) MSR_LSTAR (x86_64 only) Upstream status: submitted: http://marc.info/?l=kvm&m=125554346023751 Signed-off-by: Eduardo Habkost <ehabkost@redhat.com> --- qemu/qemu-kvm-x86.c | 6 ++++-- 1 files changed, 4 insertions(+), 2 deletions(-) Signed-off-by: Eduardo Habkost <ehabkost@redhat.com> --- qemu/qemu-kvm-x86.c | 6 ++++-- 1 files changed, 4 insertions(+), 2 deletions(-) diff --git a/qemu/qemu-kvm-x86.c b/qemu/qemu-kvm-x86.c index 5be7004..e95c489 100644 --- a/qemu/qemu-kvm-x86.c +++ b/qemu/qemu-kvm-x86.c @@ -111,9 +111,9 @@ static int get_msr_entry(struct kvm_msr_entry *entry, CPUState *env) } #ifdef TARGET_X86_64 -#define MSR_COUNT 9 +#define MSR_COUNT 10 #else -#define MSR_COUNT 5 +#define MSR_COUNT 6 #endif static void set_v8086_seg(struct kvm_segment *lhs, const SegmentCache *rhs) @@ -255,6 +255,7 @@ void kvm_arch_load_regs(CPUState *env) /* msrs */ n = 0; + /* Remember to increase MSR_COUNT if you add new registers below */ set_msr_entry(&msrs[n++], MSR_IA32_SYSENTER_CS, env->sysenter_cs); set_msr_entry(&msrs[n++], MSR_IA32_SYSENTER_ESP, env->sysenter_esp); set_msr_entry(&msrs[n++], MSR_IA32_SYSENTER_EIP, env->sysenter_eip); @@ -429,6 +430,7 @@ void kvm_arch_save_regs(CPUState *env) /* msrs */ n = 0; + /* Remember to increase MSR_COUNT if you add new registers below */ msrs[n++].index = MSR_IA32_SYSENTER_CS; msrs[n++].index = MSR_IA32_SYSENTER_ESP; msrs[n++].index = MSR_IA32_SYSENTER_EIP; -- 1.6.3.rc4.29.g8146