[Xen-changelog] [xen stable-4.4] xen: arm: Handle traps from 32-bit userspace on 64-bit kernel as undef

[patchbot@xxxxxxx]

commit 61460b58192786b206d96cf8d3cb188c364266a6
Author:     Ian Campbell <ian.campbell@xxxxxxxxxx>
AuthorDate: Tue Aug 12 15:49:14 2014 +0200
Commit:     Jan Beulich <jbeulich@xxxxxxxx>
CommitDate: Tue Aug 12 15:49:14 2014 +0200

    xen: arm: Handle traps from 32-bit userspace on 64-bit kernel as undef
    
    We are not setup to handle these properly. This turns a host crash
    into a trap to the guest kernel which will likely result in killing
    the offending process.
    
    This is part of CVE-2014-5147 / XSA-102.
    
    Signed-off-by: Ian Campbell <ian.campbell@xxxxxxxxxx>
    Acked-by: Julien Grall <julien.grall@xxxxxxxxxx>
    master commit: c0020e0997024eb741d60de9a480bf2878f891af
    master date: 2014-08-12 15:37:25 +0200
---
 xen/arch/arm/traps.c |   11 +++++++++++
 1 files changed, 11 insertions(+), 0 deletions(-)

diff --git a/xen/arch/arm/traps.c b/xen/arch/arm/traps.c
index 6536209..e763f12 100644
--- a/xen/arch/arm/traps.c
+++ b/xen/arch/arm/traps.c
@@ -1812,6 +1812,17 @@ asmlinkage void do_trap_hypervisor(struct cpu_user_regs 
*regs)
 {
     union hsr hsr = { .bits = READ_SYSREG32(ESR_EL2) };
 
+    /*
+     * We currently do not handle 32-bit userspace on 64-bit kernels
+     * correctly (See XSA-102). Until that is resolved we treat any
+     * trap from 32-bit userspace on 64-bit kernel as undefined.
+     */
+    if ( is_pv64_domain(current->domain) && psr_mode_is_32bit(regs->cpsr) )
+    {
+        inject_undef_exception(regs, hsr.len);
+        return;
+    }
+
     switch (hsr.ec) {
     case HSR_EC_WFI_WFE:
         if ( !check_conditional_instr(regs, hsr) )
--
generated by git-patchbot for /home/xen/git/xen.git#stable-4.4

_______________________________________________
Xen-changelog mailing list
Xen-changelog@xxxxxxxxxxxxx
http://lists.xensource.com/xen-changelog