diff options
author | Eugene Korenevsky <ekorenevsky@gmail.com> | 2019-06-06 00:17:39 +0300 |
---|---|---|
committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2019-07-31 07:24:41 +0200 |
commit | fd094a14290d716d901e99c356010d9ecba02d78 (patch) | |
tree | 573e7e12795aa7aa34acca64ea2d717a6d48a523 /arch/x86 | |
parent | e5415333692ec09187ad9bee1cb6115fdc667fad (diff) | |
download | linux-stable-fd094a14290d716d901e99c356010d9ecba02d78.tar.gz linux-stable-fd094a14290d716d901e99c356010d9ecba02d78.tar.bz2 linux-stable-fd094a14290d716d901e99c356010d9ecba02d78.zip |
kvm: vmx: fix limit checking in get_vmx_mem_address()
[ Upstream commit c1a9acbc5295e278d788e9f7510f543bc9864fa2 ]
Intel SDM vol. 3, 5.3:
The processor causes a
general-protection exception (or, if the segment is SS, a stack-fault
exception) any time an attempt is made to access the following addresses
in a segment:
- A byte at an offset greater than the effective limit
- A word at an offset greater than the (effective-limit – 1)
- A doubleword at an offset greater than the (effective-limit – 3)
- A quadword at an offset greater than the (effective-limit – 7)
Therefore, the generic limit checking error condition must be
exn = (off > limit + 1 - access_len) = (off + access_len - 1 > limit)
but not
exn = (off + access_len > limit)
as for now.
Also avoid integer overflow of `off` at 32-bit KVM by casting it to u64.
Note: access length is currently sizeof(u64) which is incorrect. This
will be fixed in the subsequent patch.
Signed-off-by: Eugene Korenevsky <ekorenevsky@gmail.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Diffstat (limited to 'arch/x86')
-rw-r--r-- | arch/x86/kvm/vmx/nested.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/arch/x86/kvm/vmx/nested.c b/arch/x86/kvm/vmx/nested.c index b101127e13b6..543d7d82479b 100644 --- a/arch/x86/kvm/vmx/nested.c +++ b/arch/x86/kvm/vmx/nested.c @@ -4120,7 +4120,7 @@ int get_vmx_mem_address(struct kvm_vcpu *vcpu, unsigned long exit_qualification, */ if (!(s.base == 0 && s.limit == 0xffffffff && ((s.type & 8) || !(s.type & 4)))) - exn = exn || (off + sizeof(u64) > s.limit); + exn = exn || ((u64)off + sizeof(u64) - 1 > s.limit); } if (exn) { kvm_queue_exception_e(vcpu, |