A new register was added to the load/save list on commit
d283d5a65a2bdcc570065267be21848bd6fe3d78, but MSR_COUNT was not updated, leading
to potential stack corruption on kvm_arch_save_regs().
The following registers are saved by kvm_arch_save_regs():
1) MSR_IA32_SYSENTER_CS
2) MSR_IA32_SYSENTER_ESP
3) MSR_IA32_SYSENTER_EIP
4) MSR_STAR
5) MSR_IA32_TSC
6) MSR_VM_HSAVE_PA
7) MSR_CSTAR (x86_64 only)
8) MSR_KERNELGSBASE (x86_64 only)
9) MSR_FMASK (x86_64 only)
10) MSR_LSTAR (x86_64 only)
Signed-off-by: Eduardo Habkost <ehabkost@xxxxxxxxxx>
---
qemu-kvm-x86.c | 6 ++++--
1 files changed, 4 insertions(+), 2 deletions(-)
diff --git a/qemu-kvm-x86.c b/qemu-kvm-x86.c
index acb1b91..81d2c53 100644
--- a/qemu-kvm-x86.c
+++ b/qemu-kvm-x86.c
@@ -847,9 +847,9 @@ static int get_msr_entry(struct kvm_msr_entry *entry, CPUState *env)
}
#ifdef TARGET_X86_64
-#define MSR_COUNT 9
+#define MSR_COUNT 10
#else
-#define MSR_COUNT 5
+#define MSR_COUNT 6
#endif
static void set_v8086_seg(struct kvm_segment *lhs, const SegmentCache *rhs)
@@ -991,6 +991,7 @@ void kvm_arch_load_regs(CPUState *env)
/* msrs */
n = 0;
+ /* Remember to increase MSR_COUNT if you add new registers below */
set_msr_entry(&msrs[n++], MSR_IA32_SYSENTER_CS, env->sysenter_cs);
set_msr_entry(&msrs[n++], MSR_IA32_SYSENTER_ESP, env->sysenter_esp);
set_msr_entry(&msrs[n++], MSR_IA32_SYSENTER_EIP, env->sysenter_eip);
@@ -1168,6 +1169,7 @@ void kvm_arch_save_regs(CPUState *env)
/* msrs */
n = 0;
+ /* Remember to increase MSR_COUNT if you add new registers below */
msrs[n++].index = MSR_IA32_SYSENTER_CS;
msrs[n++].index = MSR_IA32_SYSENTER_ESP;
msrs[n++].index = MSR_IA32_SYSENTER_EIP;
--
1.6.3.rc4.29.g8146
--
Eduardo
--
To unsubscribe from this list: send the line "unsubscribe kvm" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
