[Xen-devel] Re: [PATCH] Xen: fix various checks of unsigned integers < 0

[Paolo Bonzini <pbonzini@xxxxxxxxxx>]

On 10/29/2010 05:38 PM, Dan Magenheimer wrote:
> Wow, I wonder how many times this code has executed
> and returned the wrong (incorrectly sign-extended) value?
Probably never---which doesn't make the fix worthless, but is still 
never. :)  The emulator is mostly used for real mode and MMIO, but this 
is long-mode code (which rules out real mode) and the CQO instruction 
doesn't access memory (which rules out MMIO).
To trigger the bug you probably have to cause a race between a thread 
doing MMIO and a thread replacing the MMIO instruction with a CQO.  It 
can be done fairly reliably on KVM; until they were patched, this trick 
allowed to exploit emulator bugs and go from guest-ring3 to guest-ring0.
Paolo

_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-devel