mirror of https://gitlab.com/qemu-project/qemu
You cannot select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
e43ced8be1
Node.js crashes in qemu-system-s390x with random SIGSEGVs / SIGILLs.
The v8 JIT used by Node.js can garbage collect and overwrite unused
code. Overwriting is performed by WritableJitAllocation::CopyCode(),
which ultimately calls memcpy(). For certain sizes, memcpy() uses the
MVC instruction.
QEMU implements MVC and other similar instructions using helpers. While
TCG store ops invalidate affected translation blocks automatically,
helpers must do this manually by calling probe_access_flags(). The MVC
helper does this using the access_prepare() -> access_prepare_nf() ->
s390_probe_access() -> probe_access_flags() call chain.
At the last step of this chain, the store size is replaced with 0. This
causes the probe_access_flags() -> notdirty_write() ->
tb_invalidate_phys_range_fast() chain to miss some translation blocks.
When this happens, QEMU executes a mix of old and new code. This
quickly leads to either a SIGSEGV or a SIGILL in case the old code
ends in the middle of a new instruction.
Fix by passing the true size.
Reported-by: Berthold Gunreben <azouhr@opensuse.org>
Cc: Sarah Kriesch <ada.lovelace@gmx.de>
Cc: qemu-stable@nongnu.org
Closes: https://bugzilla.opensuse.org/show_bug.cgi?id=1235709
Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: David Hildenbrand <david@redhat.com>
Fixes:
|
3 weeks ago | |
|---|---|---|
| .. | ||
| cc_helper.c | 2 years ago | |
| crypto_helper.c | 2 years ago | |
| excp_helper.c | 9 months ago | |
| fpu_helper.c | 3 months ago | |
| insn-data.h.inc | 3 weeks ago | |
| insn-format.h.inc | 2 years ago | |
| int_helper.c | 1 year ago | |
| mem_helper.c | 3 weeks ago | |
| meson.build | ||
| misc_helper.c | 2 months ago | |
| s390-tod.h | ||
| tcg_s390x.h | 3 years ago | |
| translate.c | 2 months ago | |
| translate_vx.c.inc | 1 year ago | |
| vec.h | 3 years ago | |
| vec_fpu_helper.c | 3 months ago | |
| vec_helper.c | 2 years ago | |
| vec_int_helper.c | 1 year ago | |
| vec_string_helper.c | 2 years ago | |