From: Tao Cui <[email protected]> translator_ld() asserts that a page-crossing instruction reads its two pages from virtually-contiguous addresses (page0 + TARGET_PAGE_SIZE). On 32-bit targets a guest can defeat this by executing an instruction at the very end of the address space, which wraps the second page back to the start; the assert fires and QEMU aborts. This is a guest-triggered host crash (DoS).
Patch 1 takes the second page from pc when the linear page0 + TARGET_PAGE_SIZE does not land on pc's page, handling both the normal contiguous case and the wraparound case without needing the address-space width. Patch 2 adds a multiboot regression test (tests/multiboot/wraparound) that runs on qemu-system-i386 and aborts without the fix. Tao Cui (2): accel/tcg: fix crash on instruction straddling address-space end tests/multiboot: add regression test for translator_ld wraparound accel/tcg/translator.c | 16 ++++++------ tests/multiboot/Makefile | 7 +++++- tests/multiboot/run_test.sh | 8 +++++- tests/multiboot/wraparound.c | 46 ++++++++++++++++++++++++++++++++++ tests/multiboot/wraparound.out | 5 ++++ 5 files changed, 72 insertions(+), 10 deletions(-) create mode 100644 tests/multiboot/wraparound.c create mode 100644 tests/multiboot/wraparound.out -- 2.43.0
