KVM: x86: Fix TSS size check for 16-bit tasks
PATCH 1/1 KVM: x86: Fix TSS size check for 16-bit tasks
A 16-bit TSS is only 44 bytes long. So make sure to test for the correct size on task switch.
---
This is a backport of 8f2d524 from master. It applies at least down to 2.6.32 and should be considered for the stable queues.
arch/x86/kvm/x86.c | 6 +++++- 1 files changed, 5 insertions(+), 1 deletions(-)
arch/x86/kvm/x86.c +5 -1
@@ -5145,6 +5145,7 @@ int kvm_task_switch(struct kvm_vcpu *vcpu, u16 tss_selector, int reason)int ret =0 ;u32 old_tss_base =get_segment_base (vcpu,VCPU_SREG_TR );u16 old_tss_sel =get_segment_selector (vcpu,VCPU_SREG_TR ); +u32 desc_limit; old_tss_base =kvm_mmu_gva_to_gpa_write (vcpu, old_tss_base,NULL );
@@ -5167,7 +5168,10 @@ int kvm_task_switch(struct kvm_vcpu *vcpu, u16 tss_selector, int reason) } } -if (!nseg_desc.p ||get_desc_limit (&nseg_desc) <0x67 ) { + desc_limit =get_desc_limit (&nseg_desc); +if (!nseg_desc.p || + ((desc_limit <0x67 && (nseg_desc.type &8 )) || + desc_limit <0x2b )) {kvm_queue_exception_e (vcpu,TS_VECTOR , tss_selector &0xfffc );return 1 ; }
Quoted 10 lines · Jan Kiszka
A 16-bit TSS is only 44 bytes long. So make sure to test for the correct size on task switch.
Signed-off-by Jan Kiszka<[email protected]>---
This is a backport of 8f2d524 from master. It applies at least down to 2.6.32 and should be considered for the stable queues.
This (and the exception thing) does not qualify under the usual stable rules (regression or host security: in, otherwise out). I prefer to delay brining up a new guest for one release rather than risk a regression. If you have a special requirement for it this can be relaxed.
Signature · 1 line
error compiling committee.c: too many arguments to function
Quoted 12 lines · Avi Kivity
Quoted 10 lines · Jan Kiszka
A 16-bit TSS is only 44 bytes long. So make sure to test for the correct size on task switch.
Signed-off-by Jan Kiszka<[email protected]>---
This is a backport of 8f2d524 from master. It applies at least down to 2.6.32 and should be considered for the stable queues.
Quoted 5 lines
This (and the exception thing) does not qualify under the usual stable rules (regression or host security: in, otherwise out). I prefer to delay brining up a new guest for one release rather than risk a regression. If you have a special requirement for it this can be relaxed.
In the end, we have to convince the customer's distro provider to include this. It would have been easier with an upstream merge, but it also is not impossible without it.
But I'm not 100% convinced that the criteria you mentioned match all the merged stable patches. There have been feature fixes before - though they had more impact on common guests. I can understand your concerns regarding the exception fix (which diverges from master after recent refactorings), but I can't see what makes this obvious fix problematic.
Jan
Signature · 2 lines
Siemens AG, Corporate Technology, CT T DE IT 1 Corporate Competence Center Embedded Linux
Quoted 7 lines · Jan Kiszka
Quoted 7 lines
This (and the exception thing) does not qualify under the usual stable rules (regression or host security: in, otherwise out). I prefer to delay brining up a new guest for one release rather than risk a regression. If you have a special requirement for it this can be relaxed.
Quoted 7 lines
In the end, we have to convince the customer's distro provider to include this. It would have been easier with an upstream merge, but it also is not impossible without it.
But I'm not 100% convinced that the criteria you mentioned match all the merged stable patches. There have been feature fixes before - though they had more impact on common guests.
Right, we try to balance risk and pain.
Quoted 4 lines
I can understand your concerns
regarding the exception fix (which diverges from master after recent refactorings), but I can't see what makes this obvious fix problematic.
The TSS fix is indeed trivial. I'll queue it up. Nevertheless, even trivial fixes have risks.
Signature · 1 line
error compiling committee.c: too many arguments to function