[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [PATCH v2] target/s390x: Fix translation exception on illegal instru
Re: [PATCH v2] target/s390x: Fix translation exception on illegal instruction
Wed, 14 Apr 2021 10:38:13 +0200
On Tue, 13 Apr 2021 18:52:57 +0200
Ilya Leoshkevich <email@example.com> wrote:
> Hitting an uretprobe in a s390x TCG guest causes a SIGSEGV. What
> happens is:
> * uretprobe maps a userspace page containing an invalid instruction.
> * uretprobe replaces the target function's return address with the
> address of that page.
> * When tb_gen_code() is called on that page, tb->size ends up being 0
> (because the page starts with the invalid instruction), which causes
> virt_page2 to point to the previous page.
> * The previous page is not mapped, so this causes a spurious
> translation exception.
> The bug is that tb->size must never be 0: even if there is an illegal
> instruction, the instruction bytes that have been looked at must count
> towards tb->size. So adjust s390x's translate_one() to act this way
> for both illegal instructions and instructions that are known to
> generate exceptions.
> Also add an assertion to tb_gen_code() in order to detect such
> situations in future.
> Signed-off-by: Ilya Leoshkevich <firstname.lastname@example.org>
> v1: https://lists.nongnu.org/archive/html/qemu-devel/2021-04/msg02037.html
> v1 -> v2: Fix target/s390x instead of trying to tolerate tb->size == 0
> in tb_gen_code().
> accel/tcg/translate-all.c | 1 +
> target/s390x/translate.c | 16 +++++++++++-----
> 2 files changed, 12 insertions(+), 5 deletions(-)
I assume this bug is not usually hit during normal usage, right? It's
probably not release critical, so I'll line it up for 6.1 instead.