841956ecbc
- tests: bump QOS_PATH_MAX_ELEMENT_SIZE again - softmmu/physmem: fix memory leak in dirty_memory_extend() - crypto: run qcrypto_pbkdf2_count_iters in a new thread - hw/audio/virtio-sound: fix heap buffer overflow - hw/intc/arm_gic: fix spurious level triggered interrupts - ui/sdl2: set swap interval explicitly when OpenGL is enabled - target/riscv/kvm: tolerate KVM disable ext errors - virtio: remove virtio_tswap16s() call in vring_packed_event_read() - block: fix -Werror=maybe-uninitialized false-positive - hw/remote/vfio-user: Fix config space access byte order - hw/loongarch/virt: Fix memory leak - hw/intc/riscv_aplic: APLICs should add child earlier than realize - stdvga: fix screen blanking - ui/gtk: Draw guest frame at refresh cycle - target/i386: fix size of EBP writeback in gen_enter() - virtio-net: drop too short packets early - target/ppc: Fix lxv/stxv MSR facility check - target/ppc: Fix lxvx/stxvx facility check - virtio-snd: add max size bounds check in input cb(CVE-2024-7730) Signed-off-by: Jiabo Feng <fengjiabo1@huawei.com> (cherry picked from commit e2eb79f1867bb8d8d870e758f06d2a32b3a4fc8a)
44 lines
1.7 KiB
Diff
44 lines
1.7 KiB
Diff
From 6d0eefdf70135a01476b787df50f34da77ae5529 Mon Sep 17 00:00:00 2001
|
|
From: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
|
|
Date: Thu, 6 Jun 2024 10:53:19 +0100
|
|
Subject: [PATCH] target/i386: fix size of EBP writeback in gen_enter()
|
|
|
|
The calculation of FrameTemp is done using the size indicated by mo_pushpop()
|
|
before being written back to EBP, but the final writeback to EBP is done using
|
|
the size indicated by mo_stacksize().
|
|
|
|
In the case where mo_pushpop() is MO_32 and mo_stacksize() is MO_16 then the
|
|
final writeback to EBP is done using MO_16 which can leave junk in the top
|
|
16-bits of EBP after executing ENTER.
|
|
|
|
Change the writeback of EBP to use the same size indicated by mo_pushpop() to
|
|
ensure that the full value is written back.
|
|
|
|
Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
|
|
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2198
|
|
Message-ID: <20240606095319.229650-5-mark.cave-ayland@ilande.co.uk>
|
|
Cc: qemu-stable@nongnu.org
|
|
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
|
|
(cherry picked from commit 3973615e7fbaeef1deeaa067577e373781ced70a)
|
|
Signed-off-by: zhujun2 <zhujun2_yewu@cmss.chinamobile.com>
|
|
---
|
|
target/i386/tcg/translate.c | 2 +-
|
|
1 file changed, 1 insertion(+), 1 deletion(-)
|
|
|
|
diff --git a/target/i386/tcg/translate.c b/target/i386/tcg/translate.c
|
|
index dc672d7995..19b8250452 100644
|
|
--- a/target/i386/tcg/translate.c
|
|
+++ b/target/i386/tcg/translate.c
|
|
@@ -2661,7 +2661,7 @@ static void gen_enter(DisasContext *s, int esp_addend, int level)
|
|
}
|
|
|
|
/* Copy the FrameTemp value to EBP. */
|
|
- gen_op_mov_reg_v(s, a_ot, R_EBP, s->T1);
|
|
+ gen_op_mov_reg_v(s, d_ot, R_EBP, s->T1);
|
|
|
|
/* Compute the final value of ESP. */
|
|
tcg_gen_subi_tl(s->T1, s->T1, esp_addend + size * level);
|
|
--
|
|
2.41.0.windows.1
|
|
|