Re: [Xen-devel] [PATCH 1/6] x86/xstate: Fix array overrun on hardware with LWP

["Jan Beulich" <JBeulich@xxxxxxxx>]

>>> On 16.01.17 at 12:40, <andrew.cooper3@xxxxxxxxxx> wrote:
> c/s da62246e4c "x86/xsaves: enable xsaves/xrstors/xsavec in xen" introduced
> setup_xstate_features() to allocate and fill xstate_offsets[] and
> xstate_sizes[].
> 
> However, fls() casts xfeature_mask to 32bits which truncates LWP out of the
> calculation.  As a result, the arrays are allocated too short, and the cpuid
> infrastructure reads off the end of them when calculating xstate_size for the
> guest.
> 
> On one test system, this results in 0x3fec83c0 being returned as the maximum
> size of an xsave area, which surprisingly appears not to bother Windows or
> Linux too much.  I suspect they both use current size based on xcr0, which Xen
> forwards from real hardware.
> 
> Signed-off-by: Andrew Cooper <andrew.cooper3@xxxxxxxxxx>

Reviewed-by: Jan Beulich <jbeulich@xxxxxxxx>



_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxx
https://lists.xen.org/xen-devel