[Xen-changelog] [xen stable-4.6] x86/hvm: Don't corrupt the HVM context stream when writing the MSR record

[patchbot@xxxxxxx]

commit 0fbf30a7f863139dd0ac556e44f92f5787654847
Author:     Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
AuthorDate: Fri Feb 23 10:22:48 2018 +0100
Commit:     Jan Beulich <jbeulich@xxxxxxxx>
CommitDate: Fri Feb 23 10:22:48 2018 +0100

    x86/hvm: Don't corrupt the HVM context stream when writing the MSR record
    
    Ever since it was introduced in c/s bd1f0b45ff, hvm_save_cpu_msrs() has had 
a
    bug whereby it corrupts the HVM context stream if some, but fewer than the
    maximum number of MSRs are written.
    
    _hvm_init_entry() creates an hvm_save_descriptor with length for
    msr_count_max, but in the case that we write fewer than max, h->cur only 
moves
    forward by the amount of space used, causing the subsequent
    hvm_save_descriptor to be written within the bounds of the previous one.
    
    To resolve this, reduce the length reported by the descriptor to match the
    actual number of bytes used.
    
    A typical failure on the destination side looks like:
    
        (XEN) HVM4 restore: CPU_MSR 0
        (XEN) HVM4.0 restore: not enough data left to read 56 MSR bytes
        (XEN) HVM4 restore: failed to load entry 20/0
    
    Signed-off-by: Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
    Reviewed-by: Wei Liu <wei.liu2@xxxxxxxxxx>
    Reviewed-by: Jan Beulich <jbeulich@xxxxxxxx>
    master commit: d2f86bf604698806d311cc251c1b66fbb752673c
    master date: 2017-11-21 11:19:02 +0000
---
 xen/arch/x86/hvm/hvm.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/xen/arch/x86/hvm/hvm.c b/xen/arch/x86/hvm/hvm.c
index 487afb266f..dc92dca4ec 100644
--- a/xen/arch/x86/hvm/hvm.c
+++ b/xen/arch/x86/hvm/hvm.c
@@ -2302,6 +2302,7 @@ static int hvm_save_cpu_msrs(struct domain *d, 
hvm_domain_context_t *h)
 
     for_each_vcpu ( d, v )
     {
+        struct hvm_save_descriptor *d = _p(&h->data[h->cur]);
         struct hvm_msr *ctxt;
         unsigned int i;
 
@@ -2320,8 +2321,13 @@ static int hvm_save_cpu_msrs(struct domain *d, 
hvm_domain_context_t *h)
             ctxt->msr[i]._rsvd = 0;
 
         if ( ctxt->count )
+        {
+            /* Rewrite length to indicate how much space we actually used. */
+            d->length = HVM_CPU_MSR_SIZE(ctxt->count);
             h->cur += HVM_CPU_MSR_SIZE(ctxt->count);
+        }
         else
+            /* or rewind and remove the descriptor from the stream. */
             h->cur -= sizeof(struct hvm_save_descriptor);
     }
 
--
generated by git-patchbot for /home/xen/git/xen.git#stable-4.6

_______________________________________________
Xen-changelog mailing list
Xen-changelog@xxxxxxxxxxxxxxxxxxxx
https://lists.xenproject.org/xen-changelog