34 lines
1.2 KiB
Diff
34 lines
1.2 KiB
Diff
|
References: bsc#995785 CVE-2016-7092 XSA-185
|
||
|
|
|
||
|
|
# Commit c844d637d92a75854ea5c8d4e5ca34302a9f623c
|
||
|
|
# Date 2016-09-08 14:14:53 +0200
|
||
|
|
# Author Jan Beulich <jbeulich@suse.com>
|
||
|
|
# Committer Jan Beulich <jbeulich@suse.com>
|
||
|
|
x86/32on64: don't allow recursive page tables from L3
|
||
|
|
|
||
|
|
L3 entries are special in PAE mode, and hence can't reasonably be used
|
||
|
|
for setting up recursive (and hence linear) page table mappings. Since
|
||
|
|
abuse is possible when the guest in fact gets run on 4-level page
|
||
|
|
tables, this needs to be excluded explicitly.
|
||
|
|
|
||
|
|
This is XSA-185 / CVE-2016-7092.
|
||
|
|
|
||
|
|
Reported-by: Jérémie Boutoille <jboutoille@ext.quarkslab.com>
|
||
|
|
Reported-by: "栾尚聪(好风)" <shangcong.lsc@alibaba-inc.com>
|
||
|
|
Signed-off-by: Jan Beulich <jbeulich@suse.com>
|
||
|
|
Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
|
||
|
|
|
||
|
|
--- a/xen/arch/x86/mm.c
|
||
|
|
+++ b/xen/arch/x86/mm.c
|
||
|
|
@@ -1123,7 +1123,9 @@ get_page_from_l3e(
|
||
|
|
|
||
|
|
rc = get_page_and_type_from_pagenr(
|
||
|
|
l3e_get_pfn(l3e), PGT_l2_page_table, d, partial, 1);
|
||
|
|
- if ( unlikely(rc == -EINVAL) && get_l3_linear_pagetable(l3e, pfn, d) )
|
||
|
|
+ if ( unlikely(rc == -EINVAL) &&
|
||
|
|
+ !is_pv_32bit_domain(d) &&
|
||
|
|
+ get_l3_linear_pagetable(l3e, pfn, d) )
|
||
|
|
rc = 0;
|
||
|
|
|
||
|
|
return rc;
|