[Xen-changelog] [xen stable-4.7] x86/xstate: Fix array overrun on hardware with LWP

[patchbot@xxxxxxx]

commit 88ca94a6b56a94c3e95c619f2c9ed099c8bf4e9b
Author:     Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
AuthorDate: Thu Feb 9 10:28:28 2017 +0100
Commit:     Jan Beulich <jbeulich@xxxxxxxx>
CommitDate: Thu Feb 9 10:28:28 2017 +0100

    x86/xstate: Fix array overrun on hardware with LWP
    
    c/s da62246e4c "x86/xsaves: enable xsaves/xrstors/xsavec in xen" introduced
    setup_xstate_features() to allocate and fill xstate_offsets[] and
    xstate_sizes[].
    
    However, fls() casts xfeature_mask to 32bits which truncates LWP out of the
    calculation.  As a result, the arrays are allocated too short, and the cpuid
    infrastructure reads off the end of them when calculating xstate_size for 
the
    guest.
    
    On one test system, this results in 0x3fec83c0 being returned as the maximum
    size of an xsave area, which surprisingly appears not to bother Windows or
    Linux too much.  I suspect they both use current size based on xcr0, which 
Xen
    forwards from real hardware.
    
    Signed-off-by: Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
    Reviewed-by: Jan Beulich <jbeulich@xxxxxxxx>
    master commit: fe0d67576e335c02becf1cea8e67005509fa90b6
    master date: 2017-01-16 17:37:26 +0000
---
 xen/arch/x86/xstate.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/xen/arch/x86/xstate.c b/xen/arch/x86/xstate.c
index d4aa654..12a02f1 100644
--- a/xen/arch/x86/xstate.c
+++ b/xen/arch/x86/xstate.c
@@ -92,7 +92,7 @@ static int setup_xstate_features(bool_t bsp)
 
     if ( bsp )
     {
-        xstate_features = fls(xfeature_mask);
+        xstate_features = flsl(xfeature_mask);
         xstate_offsets = xzalloc_array(unsigned int, xstate_features);
         if ( !xstate_offsets )
             return -ENOMEM;
--
generated by git-patchbot for /home/xen/git/xen.git#stable-4.7

_______________________________________________
Xen-changelog mailing list
Xen-changelog@xxxxxxxxxxxxx
https://lists.xenproject.org/xen-changelog