[Xen-changelog] [xen stable-4.3] x86/hvm: fix segment validation

[patchbot@xxxxxxx]

commit 32abacd714b04e6167450b76341966d48187e4ad
Author:     Tim Deegan <tim@xxxxxxx>
AuthorDate: Mon Dec 9 14:28:06 2013 +0100
Commit:     Jan Beulich <jbeulich@xxxxxxxx>
CommitDate: Mon Dec 9 14:28:06 2013 +0100

    x86/hvm: fix segment validation
    
    Also Coverity CID 1055180.
    
    Reported-by: David Binderman <dcb314@xxxxxxxxxxx>
    Signed-off-by: Tim Deegan <tim@xxxxxxx>
    
    Use _SEGMENT_* instead of plain numbers and adjust a comment.
    
    Signed-off-by: Jan Beulich <jbeulich@xxxxxxxx>
    Reviewed-by: Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
    master commit: 6ed4bfbabd487b41021caa7ed03cee1f00ecbabf
    master date: 2013-11-26 09:54:21 +0100
---
 xen/arch/x86/hvm/hvm.c |   11 ++++++++---
 1 files changed, 8 insertions(+), 3 deletions(-)

diff --git a/xen/arch/x86/hvm/hvm.c b/xen/arch/x86/hvm/hvm.c
index e9cd4a7..a4d7af0 100644
--- a/xen/arch/x86/hvm/hvm.c
+++ b/xen/arch/x86/hvm/hvm.c
@@ -2205,7 +2205,7 @@ static int hvm_load_segment_selector(
             if ( !(desc.b & (1u<<11)) )
                 goto unmap_and_fail;
             /* Non-conforming segment: check DPL against RPL. */
-            if ( ((desc.b & (6u<<9)) != 6) && (dpl != rpl) )
+            if ( !(desc.b & _SEGMENT_EC) && (dpl != rpl) )
                 goto unmap_and_fail;
             break;
         case x86_seg_ss:
@@ -2224,8 +2224,13 @@ static int hvm_load_segment_selector(
             /* Readable code or data segment? */
             if ( (desc.b & (5u<<9)) == (4u<<9) )
                 goto unmap_and_fail;
-            /* Non-conforming segment: check DPL against RPL and CPL. */
-            if ( ((desc.b & (6u<<9)) != 6) && ((dpl < cpl) || (dpl < rpl)) )
+            /*
+             * Data or non-conforming code segment:
+             * check DPL against RPL and CPL.
+             */
+            if ( ((desc.b & (_SEGMENT_EC|_SEGMENT_CODE)) !=
+                  (_SEGMENT_EC|_SEGMENT_CODE))
+                 && ((dpl < cpl) || (dpl < rpl)) )
                 goto unmap_and_fail;
             break;
         }
--
generated by git-patchbot for /home/xen/git/xen.git#stable-4.3

_______________________________________________
Xen-changelog mailing list
Xen-changelog@xxxxxxxxxxxxx
http://lists.xensource.com/xen-changelog