Messages in this thread | | | Date | Wed, 28 Jan 2015 19:48:48 +0800 | From | Zefan Li <> | Subject | Re: [PATCH 3.4 081/177] KVM: x86: Emulator fixes for eip canonical checks on near branches |
| |
On 2015/1/28 16:49, Nadav Amit wrote: > There is a bug in this patch, so please include > 7e46dddd6f6cd5dbf3c7bd04a7e75d19475ac9f2 ("KVM: x86: Fix far-jump to > non-canonical check”) as well.
Applied. Thanks!
> > Regards, > Nadav > > lizf@kernel.org wrote: > >> From: Nadav Amit <namit@cs.technion.ac.il> >> >> 3.4.106-rc1 review patch. If anyone has any objections, please let me know. >> >> ------------------ >> >> >> commit 234f3ce485d54017f15cf5e0699cff4100121601 upstream. >> >> Before changing rip (during jmp, call, ret, etc.) the target should be asserted >> to be canonical one, as real CPUs do. During sysret, both target rsp and rip >> should be canonical. If any of these values is noncanonical, a #GP exception >> should occur. The exception to this rule are syscall and sysenter instructions >> in which the assigned rip is checked during the assignment to the relevant >> MSRs. >> >> This patch fixes the emulator to behave as real CPUs do for near branches. >> Far branches are handled by the next patch. >> >> This fixes CVE-2014-3647. >> >> Signed-off-by: Nadav Amit <namit@cs.technion.ac.il> >> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> >> [lizf: Backported to 3.4: >> - adjust context >> - use ctxt->regs rather than reg_read() and reg_write()] >> Signed-off-by: Zefan Li <lizefan@huawei.com>
| |