Ticket #5551 (closed defect: fixed)
Guru Meditation when stack pointer for trap handler is near zero
|Reported by:||diamond||Owned by:|
If the guest causes a trap, ESP is near zero, e.g. ESP=10h (this is just enough for eflags+cs+eip+errorcode without ring transition), hardware virtualization is disabled, VirtualBox goes to Guru Meditation state.
The small example is attached; it is valid bootsector, so can be installed as floppy image. This example raises #PF with ESP=10h from ring-0, in real environment the handler of #PF gots control, skips faulting instruction, and then the code enters idle state. VirtualBox goes to 'Guru Meditation' VERR_TRPM_DONT_PANIC. VBox.log is attached, VBox.png shows black screen.
According to stack trace, TRPMForwardTrap calls PGMVerifyAccess for range [esp-28h,esp), integer overflow results in negative 64-bit address, and pgmRCGst32BitGetPage does not expect this.