lkml.org 
[lkml]   [2019]   [Jul]   [19]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH AUTOSEL 5.1 053/141] kvm: vmx: fix limit checking in get_vmx_mem_address()
    Date
    From: Eugene Korenevsky <ekorenevsky@gmail.com>

    [ Upstream commit c1a9acbc5295e278d788e9f7510f543bc9864fa2 ]

    Intel SDM vol. 3, 5.3:
    The processor causes a
    general-protection exception (or, if the segment is SS, a stack-fault
    exception) any time an attempt is made to access the following addresses
    in a segment:
    - A byte at an offset greater than the effective limit
    - A word at an offset greater than the (effective-limit – 1)
    - A doubleword at an offset greater than the (effective-limit – 3)
    - A quadword at an offset greater than the (effective-limit – 7)

    Therefore, the generic limit checking error condition must be

    exn = (off > limit + 1 - access_len) = (off + access_len - 1 > limit)

    but not

    exn = (off + access_len > limit)

    as for now.

    Also avoid integer overflow of `off` at 32-bit KVM by casting it to u64.

    Note: access length is currently sizeof(u64) which is incorrect. This
    will be fixed in the subsequent patch.

    Signed-off-by: Eugene Korenevsky <ekorenevsky@gmail.com>
    Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    arch/x86/kvm/vmx/nested.c | 2 +-
    1 file changed, 1 insertion(+), 1 deletion(-)

    diff --git a/arch/x86/kvm/vmx/nested.c b/arch/x86/kvm/vmx/nested.c
    index 4ca834d22169..897ae4b62980 100644
    --- a/arch/x86/kvm/vmx/nested.c
    +++ b/arch/x86/kvm/vmx/nested.c
    @@ -4143,7 +4143,7 @@ int get_vmx_mem_address(struct kvm_vcpu *vcpu, unsigned long exit_qualification,
    */
    if (!(s.base == 0 && s.limit == 0xffffffff &&
    ((s.type & 8) || !(s.type & 4))))
    - exn = exn || (off + sizeof(u64) > s.limit);
    + exn = exn || ((u64)off + sizeof(u64) - 1 > s.limit);
    }
    if (exn) {
    kvm_queue_exception_e(vcpu,
    --
    2.20.1
    \
     
     \ /
      Last update: 2019-07-19 06:04    [W:4.090 / U:0.412 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site