]> xenbits.xensource.com Git - xen.git/commit
x86emul: don't call ->read_segment() with x86_seg_none
authorJan Beulich <jbeulich@suse.com>
Wed, 14 Aug 2024 13:40:06 +0000 (15:40 +0200)
committerJan Beulich <jbeulich@suse.com>
Wed, 14 Aug 2024 13:40:06 +0000 (15:40 +0200)
commit5ed317c45d7323a6985797dc9a2d39d8c5df8201
tree650d2142e1666468bba1e7cd16bcf8a83cdcf17c
parentd18f8153be4c57e452495f468e2e22d2b749f07f
x86emul: don't call ->read_segment() with x86_seg_none

LAR, LSL, VERR, and VERW emulation involve calling protmode_load_seg()
with x86_seg_none. The fuzzer's read_segment() hook function has an
assertion which triggers in this case. Calling the hook function,
however, makes little sense for those insns, as there's no data to
retrieve. Instead zero-filling the output structure is what properly
corresponds to those insns being invoked with a NUL selector.

While there also add a related comment at the VERR/VERW call site.

Fixes: 06a3b8cd7ad2 ("x86emul: support LAR/LSL/VERR/VERW")
Link: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=70918
Signed-off-by: Jan Beulich <jbeulich@suse.com>
Reviewed-by: Stefano Stabellini <stefano.stabellini@amd.com>
Acked-by: Andrew Cooper <andrew.cooper3@citrix.com>
xen/arch/x86/x86_emulate/x86_emulate.c