[Xen-changelog] [xen stable-4.5] x86/alternatives: correct near branch check

[patchbot@xxxxxxx]

commit 49fe83af5a18ab49d8964a3a889ba39c75c4e378
Author:     Jan Beulich <jbeulich@xxxxxxxx>
AuthorDate: Fri May 27 14:44:46 2016 +0200
Commit:     Jan Beulich <jbeulich@xxxxxxxx>
CommitDate: Fri May 27 14:44:46 2016 +0200

    x86/alternatives: correct near branch check
    
    Make sure the near JMP/CALL check doesn't consume uninitialized
    data, not even in a benign way. And relax the length check at once.
    
    Signed-off-by: Jan Beulich <jbeulich@xxxxxxxx>
    Reviewed-by: Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
    master commit: cd29140ef0e65a33d62e7f5ee843077e51913f01
    master date: 2016-03-09 16:51:16 +0100
---
 xen/arch/x86/alternative.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/xen/arch/x86/alternative.c b/xen/arch/x86/alternative.c
index 2743792..90d6f10 100644
--- a/xen/arch/x86/alternative.c
+++ b/xen/arch/x86/alternative.c
@@ -175,7 +175,7 @@ static void __init apply_alternatives(struct alt_instr 
*start, struct alt_instr
         memcpy(insnbuf, replacement, a->replacementlen);
 
         /* 0xe8/0xe9 are relative branches; fix the offset. */
-        if ( (*insnbuf & 0xfe) == 0xe8 && a->replacementlen == 5 )
+        if ( a->replacementlen >= 5 && (*insnbuf & 0xfe) == 0xe8 )
             *(s32 *)(insnbuf + 1) += replacement - instr;
 
         add_nops(insnbuf + a->replacementlen,
--
generated by git-patchbot for /home/xen/git/xen.git#stable-4.5

_______________________________________________
Xen-changelog mailing list
Xen-changelog@xxxxxxxxxxxxx
http://lists.xensource.com/xen-changelog