[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index] [xen stable-4.15] x86/HVM: fail virt-to-linear conversion for insn fetches from non-code segments
commit 78b382748015dbad7fea1c8f06c9d62fce585904 Author: Jan Beulich <jbeulich@xxxxxxxx> AuthorDate: Fri Jan 7 08:13:47 2022 +0100 Commit: Jan Beulich <jbeulich@xxxxxxxx> CommitDate: Fri Jan 7 08:13:47 2022 +0100 x86/HVM: fail virt-to-linear conversion for insn fetches from non-code segments Just like (in protected mode) reads may not go to exec-only segments and writes may not go to non-writable ones, insn fetches may not access data segments. Fixes: 623e83716791 ("hvm: Support hardware task switching") Signed-off-by: Jan Beulich <jbeulich@xxxxxxxx> Reviewed-by: Andrew Cooper <andrew.cooper3@xxxxxxxxxx> master commit: 311297f4216a4387bdae6df6cfbb1f5edb06618a master date: 2021-12-06 14:15:05 +0100 --- xen/arch/x86/hvm/hvm.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/xen/arch/x86/hvm/hvm.c b/xen/arch/x86/hvm/hvm.c index f336ffa393..5be8aee4bb 100644 --- a/xen/arch/x86/hvm/hvm.c +++ b/xen/arch/x86/hvm/hvm.c @@ -2530,6 +2530,9 @@ bool_t hvm_virtual_to_linear_addr( */ ASSERT(seg < x86_seg_none); + /* However, check that insn fetches only ever specify CS. */ + ASSERT(access_type != hvm_access_insn_fetch || seg == x86_seg_cs); + if ( !(curr->arch.hvm.guest_cr[0] & X86_CR0_PE) ) { /* @@ -2594,10 +2597,17 @@ bool_t hvm_virtual_to_linear_addr( if ( (reg->type & 0xa) == 0x8 ) goto out; /* execute-only code segment */ break; + case hvm_access_write: if ( (reg->type & 0xa) != 0x2 ) goto out; /* not a writable data segment */ break; + + case hvm_access_insn_fetch: + if ( !(reg->type & 0x8) ) + goto out; /* not a code segment */ + break; + default: break; } -- generated by git-patchbot for /home/xen/git/xen.git#stable-4.15
|
![]() |
Lists.xenproject.org is hosted with RackSpace, monitoring our |