[Xen-changelog] [xen stable-4.6] x86/nHVM: avoid NULL deref during INVLPG intercept handling

[patchbot@xxxxxxx]

commit ad1313a3b03362f0f9884bdeedf6576b56d5dead
Author:     Jan Beulich <jbeulich@xxxxxxxx>
AuthorDate: Wed Feb 17 16:40:30 2016 +0100
Commit:     Jan Beulich <jbeulich@xxxxxxxx>
CommitDate: Wed Feb 17 16:40:30 2016 +0100

    x86/nHVM: avoid NULL deref during INVLPG intercept handling

    When intercepting (or emulating) L1 guest INVLPG, the nested P2M
    pointer may be (is?) NULL, and hence there's no point in calling
    p2m_flush(). In fact doing so would cause a dereference of that NULL
    pointer at least in the ASSERT() right at the beginning of the
    function.

    While so far nothing supports hap_invlpg() being reachable from the
    INVLPG intercept paths (only INVLPG insn emulation would lead there),
    and hence the code in question (added by dd6de3ab99 ["Implement
    Nested-on-Nested"]) appears to be dead, this seems to be the change
    which can be agreed on as an immediate fix. Ideally, however, the
    problematic code would go away altogether. See thread at
    lists.xenproject.org/archives/html/xen-devel/2016-01/msg03762.html.

    Reported-by: å??令 <liuling-it@xxxxxx>
    Signed-off-by: Jan Beulich <jbeulich@xxxxxxxx>
    Reviewed-by: Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
    Acked-by: George Dunlap <george.dunlap@xxxxxxxxxx>
    master commit: 86c59615f4e7f38df24182f20d9dbdec3299c514
    master date: 2016-02-09 13:22:13 +0100
---
 xen/arch/x86/mm/hap/hap.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/xen/arch/x86/mm/hap/hap.c b/xen/arch/x86/mm/hap/hap.c
index e9c0080..6eb2167 100644
--- a/xen/arch/x86/mm/hap/hap.c
+++ b/xen/arch/x86/mm/hap/hap.c
@@ -688,7 +688,8 @@ static int hap_invlpg(struct vcpu *v, unsigned long va)
          * Must perform the flush right now or an other vcpu may
          * use it when we use the next VMRUN emulation, otherwise.
          */
-        p2m_flush(v, vcpu_nestedhvm(v).nv_p2m);
+        if ( vcpu_nestedhvm(v).nv_p2m )
+            p2m_flush(v, vcpu_nestedhvm(v).nv_p2m);
         return 1;
     }

--
generated by git-patchbot for /home/xen/git/xen.git#stable-4.6

_______________________________________________
Xen-changelog mailing list
Xen-changelog@xxxxxxxxxxxxx
http://lists.xensource.com/xen-changelog