[Xen-changelog] [xen master] x86emul: don't allow null selector for LTR

[patchbot@xxxxxxx]

commit dcfd9a5eadedc71d8546286b881bba7db152207a
Author:     Jan Beulich <jbeulich@xxxxxxxx>
AuthorDate: Mon Sep 26 17:27:06 2016 +0200
Commit:     Jan Beulich <jbeulich@xxxxxxxx>
CommitDate: Mon Sep 26 17:27:06 2016 +0200

    x86emul: don't allow null selector for LTR
    
    Signed-off-by: Jan Beulich <jbeulich@xxxxxxxx>
    Reviewed-by: Konrad Rzeszutek Wilk <konrad.wilk@xxxxxxxxxx>
    Reviewed-by: Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
---
 xen/arch/x86/x86_emulate/x86_emulate.c | 13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

diff --git a/xen/arch/x86/x86_emulate/x86_emulate.c 
b/xen/arch/x86/x86_emulate/x86_emulate.c
index 9c76c2e..b22ede6 100644
--- a/xen/arch/x86/x86_emulate/x86_emulate.c
+++ b/xen/arch/x86/x86_emulate/x86_emulate.c
@@ -1207,10 +1207,17 @@ protmode_load_seg(
     /* NULL selector? */
     if ( (sel & 0xfffc) == 0 )
     {
-        if ( (seg == x86_seg_cs) ||
-             ((seg == x86_seg_ss) &&
-              (!mode_64bit() || (cpl == 3) || (cpl != sel))) )
+        switch ( seg )
+        {
+        case x86_seg_ss:
+            if ( mode_64bit() && (cpl != 3) && (cpl == sel) )
+        default:
+                break;
+            /* fall through */
+        case x86_seg_cs:
+        case x86_seg_tr:
             goto raise_exn;
+        }
         memset(sreg, 0, sizeof(*sreg));
         sreg->sel = sel;
         return X86EMUL_OKAY;
--
generated by git-patchbot for /home/xen/git/xen.git#master

_______________________________________________
Xen-changelog mailing list
Xen-changelog@xxxxxxxxxxxxx
https://lists.xenproject.org/xen-changelog