a4d1d9fe03
bnc#828623 - bnc#839596 - VUL-0: CVE-2013-1442: XSA-62: xen: Information leak on AVX and/or LWP capable CPUs 5242a1b5-x86-xsave-initialize-extended-register-state-when-guests-enable-it.patch - bnc#840592 - VUL-0: CVE-2013-4355: XSA-63: xen: Information leaks through I/O instruction emulation CVE-2013-4355-xsa63.patch - bnc#840593 - VUL-0: CVE-2013-4356: XSA-64: xen: Memory accessible by 64-bit PV guests under live migration CVE-2013-4356-xsa64.patch - bnc#841766 - VUL-1: CVE-2013-4361: XSA-66: xen: Information leak through fbld instruction emulation CVE-2013-4361-xsa66.patch - bnc#833796 - L3: Xen: migration broken from xsave-capable to xsave-incapable host 52205e27-x86-xsave-initialization-improvements.patch 522dc0e6-x86-xsave-fix-migration-from-xsave-capable-to-xsave-incapable-host.patch - bnc#839600 - [HP BCS SLES11 Bug]: In HP’s UEFI x86_64 platform and sles11sp3 with xen environment, xen hypervisor will panic on multiple blades nPar. 523172d5-x86-fix-memory-cut-off-when-using-PFN-compression.patch - bnc#833251 - [HP BCS SLES11 Bug]: In HP’s UEFI x86_64 platform and with xen environment, in booting stage ,xen hypervisor will panic. 522d896b-x86-EFI-properly-handle-run-time-memory-regions-outside-the-1-1-map.patch - bnc#834751 - [HP BCS SLES11 Bug]: In xen, “shutdown –y 0 –h” cannot power off system 522d896b-x86-EFI-properly-handle-run-time-memory-regions-outside-the-1-1-map.patch OBS-URL: https://build.opensuse.org/package/show/Virtualization/xen?expand=0&rev=274
93 lines
3.1 KiB
Diff
93 lines
3.1 KiB
Diff
# Commit 7f12732670b31b2fea899a4160d455574658474f
|
|
# Date 2013-09-23 09:53:55 +0200
|
|
# Author Jan Beulich <jbeulich@suse.com>
|
|
# Committer Jan Beulich <jbeulich@suse.com>
|
|
x86/HVM: linear address must be canonical for the whole accessed range
|
|
|
|
... rather than just for the first byte.
|
|
|
|
While at it, also
|
|
- make the real mode case at least dpo a wrap around check
|
|
- drop the mis-named "gpf" label (we're not generating faults here)
|
|
and use in-place returns instead
|
|
|
|
Signed-off-by: Jan Beulich <jbeulich@suse.com>
|
|
Acked-by: Keir Fraser <keir@xen.org>
|
|
|
|
--- a/xen/arch/x86/hvm/hvm.c
|
|
+++ b/xen/arch/x86/hvm/hvm.c
|
|
@@ -1938,8 +1938,7 @@ int hvm_virtual_to_linear_addr(
|
|
unsigned int addr_size,
|
|
unsigned long *linear_addr)
|
|
{
|
|
- unsigned long addr = offset;
|
|
- uint32_t last_byte;
|
|
+ unsigned long addr = offset, last_byte;
|
|
|
|
if ( !(current->arch.hvm_vcpu.guest_cr[0] & X86_CR0_PE) )
|
|
{
|
|
@@ -1948,6 +1947,9 @@ int hvm_virtual_to_linear_addr(
|
|
* Certain of them are not done in native real mode anyway.
|
|
*/
|
|
addr = (uint32_t)(addr + reg->base);
|
|
+ last_byte = (uint32_t)addr + bytes - 1;
|
|
+ if ( last_byte < addr )
|
|
+ return 0;
|
|
}
|
|
else if ( addr_size != 64 )
|
|
{
|
|
@@ -1959,17 +1961,17 @@ int hvm_virtual_to_linear_addr(
|
|
{
|
|
case hvm_access_read:
|
|
if ( (reg->attr.fields.type & 0xa) == 0x8 )
|
|
- goto gpf; /* execute-only code segment */
|
|
+ return 0; /* execute-only code segment */
|
|
break;
|
|
case hvm_access_write:
|
|
if ( (reg->attr.fields.type & 0xa) != 0x2 )
|
|
- goto gpf; /* not a writable data segment */
|
|
+ return 0; /* not a writable data segment */
|
|
break;
|
|
default:
|
|
break;
|
|
}
|
|
|
|
- last_byte = offset + bytes - 1;
|
|
+ last_byte = (uint32_t)offset + bytes - 1;
|
|
|
|
/* Is this a grows-down data segment? Special limit check if so. */
|
|
if ( (reg->attr.fields.type & 0xc) == 0x4 )
|
|
@@ -1980,10 +1982,10 @@ int hvm_virtual_to_linear_addr(
|
|
|
|
/* Check first byte and last byte against respective bounds. */
|
|
if ( (offset <= reg->limit) || (last_byte < offset) )
|
|
- goto gpf;
|
|
+ return 0;
|
|
}
|
|
else if ( (last_byte > reg->limit) || (last_byte < offset) )
|
|
- goto gpf; /* last byte is beyond limit or wraps 0xFFFFFFFF */
|
|
+ return 0; /* last byte is beyond limit or wraps 0xFFFFFFFF */
|
|
|
|
/*
|
|
* Hardware truncates to 32 bits in compatibility mode.
|
|
@@ -2000,15 +2002,14 @@ int hvm_virtual_to_linear_addr(
|
|
if ( (seg == x86_seg_fs) || (seg == x86_seg_gs) )
|
|
addr += reg->base;
|
|
|
|
- if ( !is_canonical_address(addr) )
|
|
- goto gpf;
|
|
+ last_byte = addr + bytes - 1;
|
|
+ if ( !is_canonical_address(addr) || last_byte < addr ||
|
|
+ !is_canonical_address(last_byte) )
|
|
+ return 0;
|
|
}
|
|
|
|
*linear_addr = addr;
|
|
return 1;
|
|
-
|
|
- gpf:
|
|
- return 0;
|
|
}
|
|
|
|
/* On non-NULL return, we leave this function holding an additional
|