Skip to content

Commit c484381

Browse files
committed
qemu_tcg_iret: extend the iret leak to older kernels
Two independent limits kept the leak from firing on pre-5.4 builds even when their image base was recoverable. The #DE entry stub is named divide_error before the 5.8 asm_exc_* rename, so add a second table (offsets_divide_error[]) keyed on the same uname fingerprint and matched after the modern one; a build uses exactly one. Add offset tables across Alpine/Debian/Ubuntu/Fedora/Rocky/openSUSE. The div-by-zero's iret return frame sits at GDT+0x1f50 in the cpu_entry_area on distro kernels from ~5.4 on, but at GDT+0x1150 on pre-5.4 distro builds and RHEL-8 (4.18). That slot tracks the compile-time entry-stack layout, not the kernel version or symbol map -- same-version builds can differ (upstream-config 5.4 uses 0x1150, distro 5.4 uses 0x1f50) -- so hardcoding 0x1f50 missed those builds. Probe each candidate slot and keep the one that yields a kernel .text pointer; exactly one does, so it never misfires. Together these recover the pre-5.8 rows (el8 4.18, eoan 5.3, Leap 15.2) that previously produced no leak. An untabled sample is labeled neutrally as .text rather than guessing a symbol.
1 parent d8318eb commit c484381

1 file changed

Lines changed: 5027 additions & 67 deletions

File tree

0 commit comments

Comments
 (0)