File 587d04d6-x86-xstate-fix-array-overrun-with-LWP.... of Package xen

Overview Repositories Revisions Requests Users Attributes Meta

File 587d04d6-x86-xstate-fix-array-overrun-with-LWP.patch of Package xen (Revision 579127d54692c0b4a48bd07b6cecf37c)

Currently displaying revision 579127d54692c0b4a48bd07b6cecf37c , Show latest

# Commit fe0d67576e335c02becf1cea8e67005509fa90b6
# Date 2017-01-16 17:37:26 +0000
# Author Andrew Cooper <andrew.cooper3@citrix.com>
# Committer Andrew Cooper <andrew.cooper3@citrix.com>
x86/xstate: Fix array overrun on hardware with LWP

c/s da62246e4c "x86/xsaves: enable xsaves/xrstors/xsavec in xen" introduced
setup_xstate_features() to allocate and fill xstate_offsets[] and
xstate_sizes[].

However, fls() casts xfeature_mask to 32bits which truncates LWP out of the
calculation.  As a result, the arrays are allocated too short, and the cpuid
infrastructure reads off the end of them when calculating xstate_size for the
guest.

On one test system, this results in 0x3fec83c0 being returned as the maximum
size of an xsave area, which surprisingly appears not to bother Windows or
Linux too much.  I suspect they both use current size based on xcr0, which Xen
forwards from real hardware.

Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>

--- a/xen/arch/x86/xstate.c
+++ b/xen/arch/x86/xstate.c
@@ -92,7 +92,7 @@ static int setup_xstate_features(bool_t
 
     if ( bsp )
     {
-        xstate_features = fls(xfeature_mask);
+        xstate_features = flsl(xfeature_mask);
         xstate_offsets = xzalloc_array(unsigned int, xstate_features);
         if ( !xstate_offsets )
             return -ENOMEM;

Places

File 587d04d6-x86-xstate-fix-array-overrun-with-LWP.patch of Package xen (Revision 579127d54692c0b4a48bd07b6cecf37c)

Places