[Xen-changelog] [xen stable-4.7] x86/emul: Reject LGDT/LIDT attempts with non-canonical base addresses

[patchbot@xxxxxxx]

commit 0ad7781a7d7fb03a24dc6d8d5b4534029179bd58
Author:     Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
AuthorDate: Wed Jan 18 09:58:18 2017 +0100
Commit:     Jan Beulich <jbeulich@xxxxxxxx>
CommitDate: Wed Jan 18 09:58:18 2017 +0100

    x86/emul: Reject LGDT/LIDT attempts with non-canonical base addresses
    
    No sane OS would deliberately try this, but make Xen's emulation match real
    hardware by delivering #GP(0), rather than suffering a VMEntry failure.
    
    Signed-off-by: Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
    Reviewed-by: Jan Beulich <JBeulich@xxxxxxxx>
    master commit: 12bc22f79117dfae5e59382cdda6b8b6b70a7554
    master date: 2016-11-03 12:23:23 +0000
---
 xen/arch/x86/x86_emulate/x86_emulate.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/xen/arch/x86/x86_emulate/x86_emulate.c 
b/xen/arch/x86/x86_emulate/x86_emulate.c
index 77be5d3..6af4f4f 100644
--- a/xen/arch/x86/x86_emulate/x86_emulate.c
+++ b/xen/arch/x86/x86_emulate/x86_emulate.c
@@ -4023,6 +4023,7 @@ x86_emulate(
                  (rc = read_ulong(ea.mem.seg, ea.mem.off+2,
                                   &base, mode_64bit() ? 8 : 4, ctxt, ops)) )
                 goto done;
+            generate_exception_if(!is_canonical_address(base), EXC_GP, 0);
             reg.base = base;
             reg.limit = limit;
             if ( op_bytes == 2 )
--
generated by git-patchbot for /home/xen/git/xen.git#stable-4.7

_______________________________________________
Xen-changelog mailing list
Xen-changelog@xxxxxxxxxxxxx
https://lists.xenproject.org/xen-changelog