59 lines
1.8 KiB
Diff
59 lines
1.8 KiB
Diff
From: Paolo Bonzini <pbonzini@redhat.com>
|
|
Date: Fri, 19 Feb 2016 18:07:21 +0100
|
|
Subject: KVM: x86: fix conversion of addresses to linear in 32-bit protected
|
|
mode
|
|
Origin: https://git.kernel.org/linus/0c1d77f4ba5cc9c05a29adca3d6466cdf4969b70
|
|
|
|
Commit e8dd2d2d641c ("Silence compiler warning in arch/x86/kvm/emulate.c",
|
|
2015-09-06) broke boot of the Hurd. The bug is that the "default:"
|
|
case actually could modify "la", but after the patch this change is
|
|
not reflected in *linear.
|
|
|
|
The bug is visible whenever a non-zero segment base causes the linear
|
|
address to wrap around the 4GB mark.
|
|
|
|
Fixes: e8dd2d2d641cb2724ee10e76c0ad02e04289c017
|
|
Cc: stable@vger.kernel.org
|
|
Reported-by: Aurelien Jarno <aurelien@aurel32.net>
|
|
Tested-by: Aurelien Jarno <aurelien@aurel32.net>
|
|
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
|
|
---
|
|
arch/x86/kvm/emulate.c | 4 ++--
|
|
1 file changed, 2 insertions(+), 2 deletions(-)
|
|
|
|
diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c
|
|
index 1505587..b9b09fe 100644
|
|
--- a/arch/x86/kvm/emulate.c
|
|
+++ b/arch/x86/kvm/emulate.c
|
|
@@ -650,10 +650,10 @@ static __always_inline int __linearize(struct x86_emulate_ctxt *ctxt,
|
|
u16 sel;
|
|
|
|
la = seg_base(ctxt, addr.seg) + addr.ea;
|
|
- *linear = la;
|
|
*max_size = 0;
|
|
switch (mode) {
|
|
case X86EMUL_MODE_PROT64:
|
|
+ *linear = la;
|
|
if (is_noncanonical_address(la))
|
|
goto bad;
|
|
|
|
@@ -662,6 +662,7 @@ static __always_inline int __linearize(struct x86_emulate_ctxt *ctxt,
|
|
goto bad;
|
|
break;
|
|
default:
|
|
+ *linear = la = (u32)la;
|
|
usable = ctxt->ops->get_segment(ctxt, &sel, &desc, NULL,
|
|
addr.seg);
|
|
if (!usable)
|
|
@@ -689,7 +690,6 @@ static __always_inline int __linearize(struct x86_emulate_ctxt *ctxt,
|
|
if (size > *max_size)
|
|
goto bad;
|
|
}
|
|
- la &= (u32)-1;
|
|
break;
|
|
}
|
|
if (insn_aligned(ctxt, size) && ((la & (size - 1)) != 0))
|
|
--
|
|
2.7.0
|
|
|