mirror of
https://github.com/yuzu-emu/unicorn.git
synced 2024-10-21 01:18:15 +02:00
7dd4afd8d9
Besides being more correct, arbitrarily long instruction allow the
generation of a translation block that spans three pages. This
confuses the generator and even allows ring 3 code to poison the
translation block cache and inject code into other processes that are
in guest ring 3.
This is an improved (and more invasive) fix for commit 30663fd ("tcg/i386:
Check the size of instruction being translated", 2017-03-24). In addition
to being more precise (and generating the right exception, which is #GP
rather than #UD), it distinguishes better between page faults and too long
instructions, as shown by this test case:
int main()
{
char *x = mmap(NULL, 8192, PROT_READ|PROT_WRITE|PROT_EXEC,
MAP_PRIVATE|MAP_ANON, -1, 0);
memset(x, 0x66, 4096);
x[4096] = 0x90;
x[4097] = 0xc3;
char *i = x + 4096 - 15;
mprotect(x + 4096, 4096, PROT_READ|PROT_WRITE);
((void(*)(void)) i) ();
}
... which produces a #GP without the mprotect, and a #PF with it.
Backports commit b066c5375737ad0d630196dab2a2b329515a1d00 from qemu
|
||
|---|---|---|
| .. | ||
| arch_memory_mapping.c | ||
| bpt_helper.c | ||
| cc_helper_template.h | ||
| cc_helper.c | ||
| cpu-qom.h | ||
| cpu.c | ||
| cpu.h | ||
| excp_helper.c | ||
| fpu_helper.c | ||
| helper.c | ||
| helper.h | ||
| int_helper.c | ||
| Makefile.objs | ||
| mem_helper.c | ||
| misc_helper.c | ||
| mpx_helper.c | ||
| ops_sse_header.h | ||
| ops_sse.h | ||
| seg_helper.c | ||
| shift_helper_template.h | ||
| smm_helper.c | ||
| svm_helper.c | ||
| svm.h | ||
| TODO | ||
| topology.h | ||
| translate.c | ||
| unicorn.c | ||
| unicorn.h | ||