[Xen-changelog] [xen stable-4.7] x86emul: don't allow null selector for LTR

[patchbot@xxxxxxx]

commit 33c4ba9ea23b781e9436daf9a3b2013d466b7b62
Author:     Jan Beulich <jbeulich@xxxxxxxx>
AuthorDate: Wed Sep 28 16:55:47 2016 +0200
Commit:     Jan Beulich <jbeulich@xxxxxxxx>
CommitDate: Wed Sep 28 16:55:47 2016 +0200

    x86emul: don't allow null selector for LTR
    
    Signed-off-by: Jan Beulich <jbeulich@xxxxxxxx>
    Reviewed-by: Konrad Rzeszutek Wilk <konrad.wilk@xxxxxxxxxx>
    Reviewed-by: Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
    master commit: dcfd9a5eadedc71d8546286b881bba7db152207a
    master date: 2016-09-26 17:27:06 +0200
---
 xen/arch/x86/x86_emulate/x86_emulate.c | 13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

diff --git a/xen/arch/x86/x86_emulate/x86_emulate.c 
b/xen/arch/x86/x86_emulate/x86_emulate.c
index 65fece3..9809200 100644
--- a/xen/arch/x86/x86_emulate/x86_emulate.c
+++ b/xen/arch/x86/x86_emulate/x86_emulate.c
@@ -1169,10 +1169,17 @@ protmode_load_seg(
     /* NULL selector? */
     if ( (sel & 0xfffc) == 0 )
     {
-        if ( (seg == x86_seg_cs) ||
-             ((seg == x86_seg_ss) &&
-              (!mode_64bit() || (cpl == 3) || (cpl != sel))) )
+        switch ( seg )
+        {
+        case x86_seg_ss:
+            if ( mode_64bit() && (cpl != 3) && (cpl == sel) )
+        default:
+                break;
+            /* fall through */
+        case x86_seg_cs:
+        case x86_seg_tr:
             goto raise_exn;
+        }
         memset(sreg, 0, sizeof(*sreg));
         sreg->sel = sel;
         return X86EMUL_OKAY;
--
generated by git-patchbot for /home/xen/git/xen.git#stable-4.7

_______________________________________________
Xen-changelog mailing list
Xen-changelog@xxxxxxxxxxxxx
https://lists.xenproject.org/xen-changelog