[xen stable-4.15] x86/HVM: fail virt-to-linear conversion for insn fetches from non-code segments

[patchbot@xxxxxxx]

commit 78b382748015dbad7fea1c8f06c9d62fce585904
Author:     Jan Beulich <jbeulich@xxxxxxxx>
AuthorDate: Fri Jan 7 08:13:47 2022 +0100
Commit:     Jan Beulich <jbeulich@xxxxxxxx>
CommitDate: Fri Jan 7 08:13:47 2022 +0100

    x86/HVM: fail virt-to-linear conversion for insn fetches from non-code 
segments
    
    Just like (in protected mode) reads may not go to exec-only segments and
    writes may not go to non-writable ones, insn fetches may not access data
    segments.
    
    Fixes: 623e83716791 ("hvm: Support hardware task switching")
    Signed-off-by: Jan Beulich <jbeulich@xxxxxxxx>
    Reviewed-by: Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
    master commit: 311297f4216a4387bdae6df6cfbb1f5edb06618a
    master date: 2021-12-06 14:15:05 +0100
---
 xen/arch/x86/hvm/hvm.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/xen/arch/x86/hvm/hvm.c b/xen/arch/x86/hvm/hvm.c
index f336ffa393..5be8aee4bb 100644
--- a/xen/arch/x86/hvm/hvm.c
+++ b/xen/arch/x86/hvm/hvm.c
@@ -2530,6 +2530,9 @@ bool_t hvm_virtual_to_linear_addr(
      */
     ASSERT(seg < x86_seg_none);
 
+    /* However, check that insn fetches only ever specify CS. */
+    ASSERT(access_type != hvm_access_insn_fetch || seg == x86_seg_cs);
+
     if ( !(curr->arch.hvm.guest_cr[0] & X86_CR0_PE) )
     {
         /*
@@ -2594,10 +2597,17 @@ bool_t hvm_virtual_to_linear_addr(
                 if ( (reg->type & 0xa) == 0x8 )
                     goto out; /* execute-only code segment */
                 break;
+
             case hvm_access_write:
                 if ( (reg->type & 0xa) != 0x2 )
                     goto out; /* not a writable data segment */
                 break;
+
+            case hvm_access_insn_fetch:
+                if ( !(reg->type & 0x8) )
+                    goto out; /* not a code segment */
+                break;
+
             default:
                 break;
             }
--
generated by git-patchbot for /home/xen/git/xen.git#stable-4.15