File 569f8282-x86-VMX-prevent-INVVPID-failure-due-to... of Package xen

Overview Repositories Revisions Requests Users Attributes Meta

File 569f8282-x86-VMX-prevent-INVVPID-failure-due-to-non-canonical-guest-addr.patch of Package xen (Revision dbf2eede0f22d32a0cc48154739aa8fe)

Currently displaying revision dbf2eede0f22d32a0cc48154739aa8fe , Show latest

# Commit bf05e88ed7342a91cceba050b6c622accb809842
# Date 2016-01-20 13:50:10 +0100
# Author Jan Beulich <jbeulich@suse.com>
# Committer Jan Beulich <jbeulich@suse.com>
x86/VMX: prevent INVVPID failure due to non-canonical guest address

While INVLPG (and on SVM INVLPGA) don't fault on non-canonical
addresses, INVVPID fails (in the "individual address" case) when passed
such an address.

Since such intercepted INVLPG are effectively no-ops anyway, don't fix
this in vmx_invlpg_intercept(), but instead have paging_invlpg() never
return true in such a case.

This is CVE-2016-1571 / XSA-168.

Signed-off-by: Jan Beulich <jbeulich@suse.com>
Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
Acked-by: Ian Campbell <ian.campbell@citrix.com>

--- a/xen/include/asm-x86/paging.h
+++ b/xen/include/asm-x86/paging.h
@@ -238,7 +238,7 @@ paging_fault(unsigned long va, struct cp
  * or 0 if it's safe not to do so. */
 static inline int paging_invlpg(struct vcpu *v, unsigned long va)
 {
-    return paging_get_hostmode(v)->invlpg(v, va);
+    return is_canonical_address(va) && paging_get_hostmode(v)->invlpg(v, va);
 }
 
 /* Translate a guest virtual address to the frame number that the

Places

File 569f8282-x86-VMX-prevent-INVVPID-failure-due-to-non-canonical-guest-addr.patch of Package xen (Revision dbf2eede0f22d32a0cc48154739aa8fe)

Places