From df9a3372ddebfcfc135861fa2d53cef6f98065f9 Mon Sep 17 00:00:00 2001 From: Mathias Krause Date: Thu, 12 Jun 2025 16:21:55 +0200 Subject: [PATCH] target/i386: Fix CR2 handling for non-canonical addresses Commit 3563362ddfae ("target/i386: Introduce structures for mmu_translate") accidentally modified CR2 for non-canonical address exceptions while these should lead to a #GP / #SS instead -- without changing CR2. Fix that. A KUT test for this was submitted as [1]. [1] https://lore.kernel.org/kvm/20250612141637.131314-1-minipli@grsecurity.net/ Fixes: 3563362ddfae ("target/i386: Introduce structures for mmu_translate") Signed-off-by: Mathias Krause Link: https://lore.kernel.org/r/20250612142155.132175-1-minipli@grsecurity.net Cc: qemu-stable@nongnu.org Signed-off-by: Paolo Bonzini --- target/i386/tcg/system/excp_helper.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/target/i386/tcg/system/excp_helper.c b/target/i386/tcg/system/excp_helper.c index 50040f6fca..f622b5d588 100644 --- a/target/i386/tcg/system/excp_helper.c +++ b/target/i386/tcg/system/excp_helper.c @@ -592,7 +592,8 @@ static bool get_physical_address(CPUX86State *env, vaddr addr, if (sext != 0 && sext != -1) { *err = (TranslateFault){ .exception_index = EXCP0D_GPF, - .cr2 = addr, + /* non-canonical #GP doesn't change CR2 */ + .cr2 = env->cr[2], }; return false; } -- 2.47.3