Commit c1a9acbc authored by Eugene Korenevsky's avatar Eugene Korenevsky Committed by Paolo Bonzini

kvm: vmx: fix limit checking in get_vmx_mem_address()

Intel SDM vol. 3, 5.3:
The processor causes a
general-protection exception (or, if the segment is SS, a stack-fault
exception) any time an attempt is made to access the following addresses
in a segment:
- A byte at an offset greater than the effective limit
- A word at an offset greater than the (effective-limit – 1)
- A doubleword at an offset greater than the (effective-limit – 3)
- A quadword at an offset greater than the (effective-limit – 7)

Therefore, the generic limit checking error condition must be

exn = (off > limit + 1 - access_len) = (off + access_len - 1 > limit)

but not

exn = (off + access_len > limit)

as for now.

Also avoid integer overflow of `off` at 32-bit KVM by casting it to u64.

Note: access length is currently sizeof(u64) which is incorrect. This
will be fixed in the subsequent patch.
Signed-off-by: default avatarEugene Korenevsky <ekorenevsky@gmail.com>
Signed-off-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
parent a87f2d3a
...@@ -4115,7 +4115,7 @@ int get_vmx_mem_address(struct kvm_vcpu *vcpu, unsigned long exit_qualification, ...@@ -4115,7 +4115,7 @@ int get_vmx_mem_address(struct kvm_vcpu *vcpu, unsigned long exit_qualification,
*/ */
if (!(s.base == 0 && s.limit == 0xffffffff && if (!(s.base == 0 && s.limit == 0xffffffff &&
((s.type & 8) || !(s.type & 4)))) ((s.type & 8) || !(s.type & 4))))
exn = exn || (off + sizeof(u64) > s.limit); exn = exn || ((u64)off + sizeof(u64) - 1 > s.limit);
} }
if (exn) { if (exn) {
kvm_queue_exception_e(vcpu, kvm_queue_exception_e(vcpu,
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment