[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [Qemu-devel] [BUG] user-to-root privesc inside VM via bad translatio
From: |
Peter Maydell |
Subject: |
Re: [Qemu-devel] [BUG] user-to-root privesc inside VM via bad translation caching |
Date: |
Wed, 22 Mar 2017 15:21:25 +0000 |
On 22 March 2017 at 15:14, Pranith Kumar <address@hidden> wrote:
> On Wed, Mar 22, 2017 at 11:04 AM, Peter Maydell
> <address@hidden> wrote:
>> This doesn't look right because it means we'll check
>> only after we've emitted all the code to do the
>> instruction operation, so the effect will be
>> "execute instruction, then take illegal-opcode
>> exception".
> The pc is restored to original address (s->pc = pc_start), so the
> exception will overwrite the generated illegal instruction and will be
> executed first.
s->pc is the guest PC -- moving that backwards will
not do anything about the generated TCG IR that's
already been written. You'd need to rewind the
write pointer in the IR stream, which there is
no support for doing AFAIK.
thanks
-- PMM
- [Qemu-devel] [BUG] user-to-root privesc inside VM via bad translation caching, Jann Horn, 2017/03/20
- Re: [Qemu-devel] [BUG] user-to-root privesc inside VM via bad translation caching, Peter Maydell, 2017/03/20
- Re: [Qemu-devel] [BUG] user-to-root privesc inside VM via bad translation caching, Pranith Kumar, 2017/03/22
- Re: [Qemu-devel] [BUG] user-to-root privesc inside VM via bad translation caching, Peter Maydell, 2017/03/22
- Re: [Qemu-devel] [BUG] user-to-root privesc inside VM via bad translation caching, Pranith Kumar, 2017/03/22
- Re: [Qemu-devel] [BUG] user-to-root privesc inside VM via bad translation caching,
Peter Maydell <=
- Re: [Qemu-devel] [BUG] user-to-root privesc inside VM via bad translation caching, Pranith Kumar, 2017/03/22
- Re: [Qemu-devel] [BUG] user-to-root privesc inside VM via bad translation caching, Richard Henderson, 2017/03/22
- Re: [Qemu-devel] [BUG] user-to-root privesc inside VM via bad translation caching, Paolo Bonzini, 2017/03/23
- Re: [Qemu-devel] [BUG] user-to-root privesc inside VM via bad translation caching, Pranith Kumar, 2017/03/23
- Re: [Qemu-devel] [BUG] user-to-root privesc inside VM via bad translation caching, Paolo Bonzini, 2017/03/23
- Re: [Qemu-devel] [BUG] user-to-root privesc inside VM via bad translation caching, Pranith Kumar, 2017/03/23