From: Jan Beulich <jbeulich@suse.com>
To: "xen-devel@lists.xenproject.org" <xen-devel@lists.xenproject.org>
Cc: "Andrew Cooper" <andrew.cooper3@citrix.com>,
"Wei Liu" <wl@xen.org>, "Roger Pau Monné" <roger.pau@citrix.com>
Subject: [PATCH v3 1/3] x86: relax GDT check in arch_set_info_guest()
Date: Wed, 20 May 2020 09:53:50 +0200 [thread overview]
Message-ID: <acbaead9-0f6c-3606-e809-57dafe9b3f01@suse.com> (raw)
In-Reply-To: <cbed3c45-3685-4bce-9719-93b1e8a2599a@suse.com>
It is wrong for us to check frames beyond the guest specified limit
(in the compat case another loop bound is already correct).
Signed-off-by: Jan Beulich <jbeulich@suse.com>
---
v3: Move nr_gdt_frames range check earlier. Avoid |= where not really
needed.
--- a/xen/arch/x86/domain.c
+++ b/xen/arch/x86/domain.c
@@ -840,6 +840,7 @@ int arch_set_info_guest(
#ifdef CONFIG_PV
mfn_t cr3_mfn;
struct page_info *cr3_page = NULL;
+ unsigned int nr_gdt_frames;
int rc = 0;
#endif
@@ -957,6 +958,10 @@ int arch_set_info_guest(
/* Ensure real hardware interrupts are enabled. */
v->arch.user_regs.eflags |= X86_EFLAGS_IF;
+ nr_gdt_frames = DIV_ROUND_UP(c(gdt_ents), 512);
+ if ( nr_gdt_frames > ARRAY_SIZE(v->arch.pv.gdt_frames) )
+ return -EINVAL;
+
if ( !v->is_initialised )
{
if ( !compat && !(flags & VGCF_in_kernel) && !c.nat->ctrlreg[1] )
@@ -988,9 +993,9 @@ int arch_set_info_guest(
fail = compat_pfn_to_cr3(pfn) != c.cmp->ctrlreg[3];
}
- for ( i = 0; i < ARRAY_SIZE(v->arch.pv.gdt_frames); ++i )
- fail |= v->arch.pv.gdt_frames[i] != c(gdt_frames[i]);
fail |= v->arch.pv.gdt_ents != c(gdt_ents);
+ for ( i = 0; !fail && i < nr_gdt_frames; ++i )
+ fail = v->arch.pv.gdt_frames[i] != c(gdt_frames[i]);
fail |= v->arch.pv.ldt_base != c(ldt_base);
fail |= v->arch.pv.ldt_ents != c(ldt_ents);
@@ -1095,12 +1100,8 @@ int arch_set_info_guest(
else
{
unsigned long gdt_frames[ARRAY_SIZE(v->arch.pv.gdt_frames)];
- unsigned int nr_frames = DIV_ROUND_UP(c.cmp->gdt_ents, 512);
-
- if ( nr_frames > ARRAY_SIZE(v->arch.pv.gdt_frames) )
- return -EINVAL;
- for ( i = 0; i < nr_frames; ++i )
+ for ( i = 0; i < nr_gdt_frames; ++i )
gdt_frames[i] = c.cmp->gdt_frames[i];
rc = (int)pv_set_gdt(v, gdt_frames, c.cmp->gdt_ents);
next prev parent reply other threads:[~2020-05-20 7:54 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-05-20 7:50 [PATCH v3 0/3] x86: XSA-298 follow-up Jan Beulich
2020-05-20 7:53 ` Jan Beulich [this message]
2020-05-20 10:20 ` [PATCH v3 1/3] x86: relax GDT check in arch_set_info_guest() Roger Pau Monné
2020-05-22 13:27 ` Andrew Cooper
2020-05-22 14:14 ` Jan Beulich
2020-05-20 7:54 ` [PATCH v3 2/3] x86: relax LDT " Jan Beulich
2020-05-20 7:54 ` [PATCH v3 3/3] x86/PV: polish pv_set_gdt() Jan Beulich
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=acbaead9-0f6c-3606-e809-57dafe9b3f01@suse.com \
--to=jbeulich@suse.com \
--cc=andrew.cooper3@citrix.com \
--cc=roger.pau@citrix.com \
--cc=wl@xen.org \
--cc=xen-devel@lists.xenproject.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).