Ticket #5551 (closed defect: fixed)

Opened 8 years ago

Last modified 8 years ago

Guru Meditation when stack pointer for trap handler is near zero

Reported by: diamond Owned by:
Priority: major Component: VMM/RAW
Version: VirtualBox 3.0.12 Keywords:
Cc: Guest type: other
Host type: other


If the guest causes a trap, ESP is near zero, e.g. ESP=10h (this is just enough for eflags+cs+eip+errorcode without ring transition), hardware virtualization is disabled, VirtualBox goes to Guru Meditation state.

The small example is attached; it is valid bootsector, so can be installed as floppy image. This example raises #PF with ESP=10h from ring-0, in real environment the handler of #PF gots control, skips faulting instruction, and then the code enters idle state. VirtualBox goes to 'Guru Meditation' VERR_TRPM_DONT_PANIC. VBox.log is attached, VBox.png shows black screen.

According to stack trace, TRPMForwardTrap calls PGMVerifyAccess for range [esp-28h,esp), integer overflow results in negative 64-bit address, and pgmRCGst32BitGetPage does not expect this.


VBox.log Download (146.9 KB) - added by diamond 8 years ago.
1.bin Download (512 bytes) - added by diamond 8 years ago.
bootsector, which causes guru meditation

Change History

Changed 8 years ago by diamond

Changed 8 years ago by diamond

bootsector, which causes guru meditation

comment:1 Changed 8 years ago by sandervl73

  • Status changed from new to closed
  • Resolution set to fixed

Thanks for the report. I've added some extra boundary checks for 32 bits paging modes.

Note: See TracTickets for help on using tickets.
ContactPrivacy policyTerms of Use