GIT: unionfs2-2.6.27.y: KVM: x86 emulator: limit instructions to 15 bytes

[Erez Zadok]

commit 8b91c56fd291670294e197bc2d25ba3844cc53fa
Author: Avi Kivity <avi at redhat.com>
Date:   Tue Nov 24 13:20:15 2009 +0200

    KVM: x86 emulator: limit instructions to 15 bytes
    
    commit eb3c79e64a70fb8f7473e30fa07e89c1ecc2c9bb upstream
    
    [ <cebbert at redhat.com>: backport to 2.6.27 ]
    
    While we are never normally passed an instruction that exceeds 15 bytes,
    smp games can cause us to attempt to interpret one, which will cause
    large latencies in non-preempt hosts.
    
    Signed-off-by: Avi Kivity <avi at redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>

diff --git a/arch/x86/kvm/x86_emulate.c b/arch/x86/kvm/x86_emulate.c
index f2f9046..1dc1cfd 100644
--- a/arch/x86/kvm/x86_emulate.c
+++ b/arch/x86/kvm/x86_emulate.c
@@ -581,6 +581,9 @@ static int do_insn_fetch(struct x86_emulate_ctxt *ctxt,
 {
 	int rc = 0;
 
+	/* x86 instructions are limited to 15 bytes. */
+	if (eip + size - ctxt->decode.eip_orig > 15)
+		return X86EMUL_UNHANDLEABLE;
 	eip += ctxt->cs_base;
 	while (size--) {
 		rc = do_fetch_insn_byte(ctxt, ops, eip++, dest++);
@@ -839,7 +842,7 @@ x86_decode_insn(struct x86_emulate_ctxt *ctxt, struct x86_emulate_ops *ops)
 	/* Shadow copy of register state. Committed on successful emulation. */
 
 	memset(c, 0, sizeof(struct decode_cache));
-	c->eip = ctxt->vcpu->arch.rip;
+	c->eip = c->eip_orig = ctxt->vcpu->arch.rip;
 	ctxt->cs_base = seg_base(ctxt, VCPU_SREG_CS);
 	memcpy(c->regs, ctxt->vcpu->arch.regs, sizeof c->regs);
 
diff --git a/include/asm-x86/kvm_x86_emulate.h b/include/asm-x86/kvm_x86_emulate.h
index 4e8c1e4..fcbb680 100644
--- a/include/asm-x86/kvm_x86_emulate.h
+++ b/include/asm-x86/kvm_x86_emulate.h
@@ -128,7 +128,7 @@ struct decode_cache {
 	u8 seg_override;
 	unsigned int d;
 	unsigned long regs[NR_VCPU_REGS];
-	unsigned long eip;
+	unsigned long eip, eip_orig;
 	/* modrm */
 	u8 modrm;
 	u8 modrm_mod;