KVM: x86: Fix uninitialized op->type for some immediate values

The emulator could reuse an op->type from a previous instruction for some
immediate values.  If it mistakenly considers the operands as memory
operands, it will performs a memory read and overwrite op->val.

Consider for instance the ROR instruction - src2 (the number of times)
would be read from memory instead of being used as immediate.

Mark every immediate operand as such to avoid this problem.

Cc: stable@vger.kernel.org
Fixes: c44b4c6ab80eef3a9c52c7b3f0c632942e6489aa
Signed-off-by: Nadav Amit <namit@cs.technion.ac.il>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

1 files changed, 8 insertions, 0 deletions

diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c
index 5edf088ca51e..9f8a2faf5040 100644
--- a/arch/x86/kvm/emulate.c
+++ b/arch/x86/kvm/emulate.c
@@ -4287,6 +4287,7 @@ static int decode_operand(struct x86_emulate_ctxt *ctxt, struct operand *op,
                 fetch_register_operand(op);
                 break;
         case OpCL:
+                op->type = OP_IMM;
                 op->bytes = 1;
                 op->val = reg_read(ctxt, VCPU_REGS_RCX) & 0xff;
                 break;
@@ -4294,6 +4295,7 @@ static int decode_operand(struct x86_emulate_ctxt *ctxt, struct operand *op,
                 rc = decode_imm(ctxt, op, 1, true);
                 break;
         case OpOne:
+                op->type = OP_IMM;
                 op->bytes = 1;
                 op->val = 1;
                 break;
@@ -4352,21 +4354,27 @@ static int decode_operand(struct x86_emulate_ctxt *ctxt, struct operand *op,
                 ctxt->memop.bytes = ctxt->op_bytes + 2;
                 goto mem_common;
         case OpES:
+                op->type = OP_IMM;
                 op->val = VCPU_SREG_ES;
                 break;
         case OpCS:
+                op->type = OP_IMM;
                 op->val = VCPU_SREG_CS;
                 break;
         case OpSS:
+                op->type = OP_IMM;
                 op->val = VCPU_SREG_SS;
                 break;
         case OpDS:
+                op->type = OP_IMM;
                 op->val = VCPU_SREG_DS;
                 break;
         case OpFS:
+                op->type = OP_IMM;
                 op->val = VCPU_SREG_FS;
                 break;
         case OpGS:
+                op->type = OP_IMM;
                 op->val = VCPU_SREG_GS;
                 break;
         case OpImplicit: