You cannot select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

Peter Maydell 4f503afc7e target/x86: Correctly handle invalid 0x0f 0xc7 0xxx insns ... In the decode_group9() function, if we don't recognise the insn as one that we should handle, we leave the 'entry' pointer unaltered. Because the X86OpEntry struct has a union for the gen and decode pointers, this means that the top level code will call decode.e.gen() which tries to use the decode function pointer (still set to decode_group9) as a gen function pointer. This is undefined behaviour, but seems to be mostly harmless in practice (we call decode_group9() again with bogus arguments and it does nothing). If you have CFI enabled then it will trip the CFI check: ../target/i386/tcg/decode-new.c.inc:2862:9: runtime error: control flow integrity check for type 'void (struct DisasContext *, struct X86DecodedInsn *)' failed during indirect function call Set *entry to UNKNOWN_OPCODE to provoke the #UD exception, as we do in decode_group1A() and decode_group11() for similar situations. Thanks to the bug reporter for the clear description and analysis of the bug and the simple reproducer. Cc: qemu-stable@nongnu.org Resolves: https://gitlab.com/qemu-project/qemu/-/issues/3172 Fixes: fcd16539eb ("target/i386: convert CMPXCHG8B/CMPXCHG16B to new decoder") Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-ID: <20251021173152.1695997-1-peter.maydell@linaro.org>		4 days ago
..
alpha	target/alpha: call plugin trap callbacks	2 weeks ago
arm	target-arm queue:	2 weeks ago
avr	target/avr: call plugin trap callbacks	2 weeks ago
hexagon	target/hexagon: Only indent on linux	4 weeks ago
hppa	target/hppa: call plugin trap callbacks	2 weeks ago
i386	target/x86: Correctly handle invalid 0x0f 0xc7 0xxx insns	4 days ago
loongarch	loongarch queue	2 weeks ago
m68k	target/m68k: call plugin trap callbacks	2 weeks ago
microblaze	maintainer updates for 10.2	2 weeks ago
mips	target/mips: call plugin trap callbacks	2 weeks ago
openrisc	target/openrisc: call plugin trap callbacks	2 weeks ago
ppc	ppc queue for 10.2	2 weeks ago
riscv	target/riscv: call plugin trap callbacks	2 weeks ago
rx	rx: cpu: fix interrupts check in rx_cpu_do_interrupt()	2 weeks ago
s390x	target/s390x: Use address generation for register branch targets	2 weeks ago
sh4	target/sh4: call plugin trap callbacks	2 weeks ago
sparc	target/sparc: call plugin trap callbacks	2 weeks ago
tricore	target/tricore: call plugin trap callbacks	2 weeks ago
xtensa	target/xtensa: call plugin trap callbacks	2 weeks ago
Kconfig	target/cris: Remove the deprecated CRIS target	1 year ago
meson.build	target/cris: Remove the deprecated CRIS target	1 year ago