From: Peter Maydell <[email protected]> In the decode_group9() function, if we don't recognise the insn as one that we should handle, we leave the 'entry' pointer unaltered. Because the X86OpEntry struct has a union for the gen and decode pointers, this means that the top level code will call decode.e.gen() which tries to use the decode function pointer (still set to decode_group9) as a gen function pointer.
This is undefined behaviour, but seems to be mostly harmless in practice (we call decode_group9() again with bogus arguments and it does nothing). If you have CFI enabled then it will trip the CFI check: ../target/i386/tcg/decode-new.c.inc:2862:9: runtime error: control flow integrity check for type 'void (struct DisasContext *, struct X86DecodedInsn *)' failed during indirect function call Set *entry to UNKNOWN_OPCODE to provoke the #UD exception, as we do in decode_group1A() and decode_group11() for similar situations. Thanks to the bug reporter for the clear description and analysis of the bug and the simple reproducer. Cc: [email protected] Resolves: https://gitlab.com/qemu-project/qemu/-/issues/3172 Fixes: fcd16539ebfe2 ("target/i386: convert CMPXCHG8B/CMPXCHG16B to new decoder") Signed-off-by: Peter Maydell <[email protected]> Reviewed-by: Richard Henderson <[email protected]> Signed-off-by: Richard Henderson <[email protected]> Message-ID: <[email protected]> --- target/i386/tcg/decode-new.c.inc | 2 ++ 1 file changed, 2 insertions(+) diff --git a/target/i386/tcg/decode-new.c.inc b/target/i386/tcg/decode-new.c.inc index a50f57dbaa..f4192f1006 100644 --- a/target/i386/tcg/decode-new.c.inc +++ b/target/i386/tcg/decode-new.c.inc @@ -335,6 +335,8 @@ static void decode_group9(DisasContext *s, CPUX86State *env, X86OpEntry *entry, *entry = group9_reg; } else if (op == 1) { *entry = REX_W(s) ? cmpxchg16b : cmpxchg8b; + } else { + *entry = UNKNOWN_OPCODE; } } -- 2.43.0
