Commit c484381
committed
qemu_tcg_iret: extend the iret leak to older kernels
Two independent limits kept the leak from firing on pre-5.4 builds even when
their image base was recoverable.
The #DE entry stub is named divide_error before the 5.8 asm_exc_* rename, so
add a second table (offsets_divide_error[]) keyed on the same uname
fingerprint and matched after the modern one; a build uses exactly one.
Add offset tables across Alpine/Debian/Ubuntu/Fedora/Rocky/openSUSE.
The div-by-zero's iret return frame sits at GDT+0x1f50 in the cpu_entry_area
on distro kernels from ~5.4 on, but at GDT+0x1150 on pre-5.4 distro builds
and RHEL-8 (4.18). That slot tracks the compile-time entry-stack layout, not
the kernel version or symbol map -- same-version builds can differ
(upstream-config 5.4 uses 0x1150, distro 5.4 uses 0x1f50) -- so hardcoding
0x1f50 missed those builds. Probe each candidate slot and keep the one that
yields a kernel .text pointer; exactly one does, so it never misfires.
Together these recover the pre-5.8 rows (el8 4.18, eoan 5.3, Leap 15.2) that
previously produced no leak. An untabled sample is labeled neutrally as
.text rather than guessing a symbol.1 parent d8318eb commit c484381
1 file changed
Lines changed: 5027 additions & 67 deletions
0 commit comments