[Xen-changelog] [xen stable-4.7] x86/emul: Correct the return value handling of VMFUNC

[patchbot@xxxxxxx]

commit 24dc62731cd198d0396135392338abb3d285b18a
Author:     Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
AuthorDate: Wed Jan 18 10:11:50 2017 +0100
Commit:     Jan Beulich <jbeulich@xxxxxxxx>
CommitDate: Wed Jan 18 10:11:50 2017 +0100

    x86/emul: Correct the return value handling of VMFUNC
    
    The bracketing of x86_emulate() calling the ops->vmfunc() hook is wrong with
    respect to the assignment to rc, which can trip the new assertions in
    x86_emulate_wrapper().
    
    The hvmemul_vmfunc() hook should only raise #UD if X86EMUL_EXCEPTION is
    returned.  This is only a latent bug at the moment.
    
    Signed-off-by: Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
    Reviewed-by: Jan Beulich <jbeulich@xxxxxxxx>
    master commit: 3ab1876504d409689824e161a8b04e57e1e5dd46
    master date: 2016-12-22 13:32:46 +0000
---
 xen/arch/x86/hvm/emulate.c             | 2 +-
 xen/arch/x86/x86_emulate/x86_emulate.c | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/xen/arch/x86/hvm/emulate.c b/xen/arch/x86/hvm/emulate.c
index ea84f91..791640b 100644
--- a/xen/arch/x86/hvm/emulate.c
+++ b/xen/arch/x86/hvm/emulate.c
@@ -1646,7 +1646,7 @@ static int hvmemul_vmfunc(
     if ( !hvm_funcs.altp2m_vcpu_emulate_vmfunc )
         return X86EMUL_UNHANDLEABLE;
     rc = hvm_funcs.altp2m_vcpu_emulate_vmfunc(ctxt->regs);
-    if ( rc != X86EMUL_OKAY )
+    if ( rc == X86EMUL_EXCEPTION )
         hvmemul_inject_hw_exception(TRAP_invalid_op, HVM_DELIVER_NO_ERROR_CODE,
                                     ctxt);
 
diff --git a/xen/arch/x86/x86_emulate/x86_emulate.c 
b/xen/arch/x86/x86_emulate/x86_emulate.c
index 6517a6e..cfb33f3 100644
--- a/xen/arch/x86/x86_emulate/x86_emulate.c
+++ b/xen/arch/x86/x86_emulate/x86_emulate.c
@@ -3981,7 +3981,7 @@ x86_emulate(
             generate_exception_if(lock_prefix | rep_prefix() | (vex.pfx == 
vex_66),
                                   EXC_UD, -1);
             fail_if(ops->vmfunc == NULL);
-            if ( (rc = ops->vmfunc(ctxt) != X86EMUL_OKAY) )
+            if ( (rc = ops->vmfunc(ctxt)) != X86EMUL_OKAY )
                 goto done;
             goto no_writeback;
        case 0xfc: /* clzero */ {
--
generated by git-patchbot for /home/xen/git/xen.git#stable-4.7

_______________________________________________
Xen-changelog mailing list
Xen-changelog@xxxxxxxxxxxxx
https://lists.xenproject.org/xen-changelog