KVM: x86: pop sreg accesses only 2 bytes
Although pop sreg updates RSP according to the operand size, only 2 bytes are read. The current behavior may result in incorrect #GP or #PF exceptions. Signed-off-by: Nadav Amit <namit@cs.technion.ac.il> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
This commit is contained in:
parent
fa4a2c080e
commit
3313bc4ee8
|
@ -1828,12 +1828,14 @@ static int em_pop_sreg(struct x86_emulate_ctxt *ctxt)
|
|||
unsigned long selector;
|
||||
int rc;
|
||||
|
||||
rc = emulate_pop(ctxt, &selector, ctxt->op_bytes);
|
||||
rc = emulate_pop(ctxt, &selector, 2);
|
||||
if (rc != X86EMUL_CONTINUE)
|
||||
return rc;
|
||||
|
||||
if (ctxt->modrm_reg == VCPU_SREG_SS)
|
||||
ctxt->interruptibility = KVM_X86_SHADOW_INT_MOV_SS;
|
||||
if (ctxt->op_bytes > 2)
|
||||
rsp_increment(ctxt, ctxt->op_bytes - 2);
|
||||
|
||||
rc = load_segment_descriptor(ctxt, (u16)selector, seg);
|
||||
return rc;
|
||||
|
|
Loading…
Reference in a new issue