[Xen-changelog] [xen master] x86/VMX: prevent INVVPID failure due to non-canonical guest address

[patchbot@xxxxxxx]

commit bf05e88ed7342a91cceba050b6c622accb809842
Author:     Jan Beulich <jbeulich@xxxxxxxx>
AuthorDate: Wed Jan 20 13:50:10 2016 +0100
Commit:     Jan Beulich <jbeulich@xxxxxxxx>
CommitDate: Wed Jan 20 13:50:10 2016 +0100

    x86/VMX: prevent INVVPID failure due to non-canonical guest address
    
    While INVLPG (and on SVM INVLPGA) don't fault on non-canonical
    addresses, INVVPID fails (in the "individual address" case) when passed
    such an address.
    
    Since such intercepted INVLPG are effectively no-ops anyway, don't fix
    this in vmx_invlpg_intercept(), but instead have paging_invlpg() never
    return true in such a case.
    
    This is CVE-2016-1571 / XSA-168.
    
    Signed-off-by: Jan Beulich <jbeulich@xxxxxxxx>
    Reviewed-by: Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
    Acked-by: Ian Campbell <ian.campbell@xxxxxxxxxx>
---
 xen/include/asm-x86/paging.h |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/xen/include/asm-x86/paging.h b/xen/include/asm-x86/paging.h
index 483b2d7..6215f57 100644
--- a/xen/include/asm-x86/paging.h
+++ b/xen/include/asm-x86/paging.h
@@ -245,7 +245,7 @@ paging_fault(unsigned long va, struct cpu_user_regs *regs)
  * or 0 if it's safe not to do so. */
 static inline int paging_invlpg(struct vcpu *v, unsigned long va)
 {
-    return paging_get_hostmode(v)->invlpg(v, va);
+    return is_canonical_address(va) && paging_get_hostmode(v)->invlpg(v, va);
 }
 
 /* Translate a guest virtual address to the frame number that the
--
generated by git-patchbot for /home/xen/git/xen.git#master

_______________________________________________
Xen-changelog mailing list
Xen-changelog@xxxxxxxxxxxxx
http://lists.xensource.com/xen-changelog