diff mbox

x86emul: don't allow null selector for LTR

Message ID 57E3987E020000780011162A@prv-mh.provo.novell.com (mailing list archive)
State New, archived
Headers show

Commit Message

Jan Beulich Sept. 22, 2016, 6:38 a.m. UTC 
Signed-off-by: Jan Beulich <jbeulich@suse.com>
---
This goes on top of
https://lists.xenproject.org/archives/html/xen-devel/2016-09/msg02198.html
x86emul: don't allow null selector for LTR

Signed-off-by: Jan Beulich <jbeulich@suse.com>
---
This goes on top of
https://lists.xenproject.org/archives/html/xen-devel/2016-09/msg02198.html

--- a/xen/arch/x86/x86_emulate/x86_emulate.c
+++ b/xen/arch/x86/x86_emulate/x86_emulate.c
@@ -1207,10 +1207,17 @@ protmode_load_seg(
     /* NULL selector? */
     if ( (sel & 0xfffc) == 0 )
     {
-        if ( (seg == x86_seg_cs) ||
-             ((seg == x86_seg_ss) &&
-              (!mode_64bit() || (cpl == 3) || (cpl != sel))) )
+        switch ( seg )
+        {
+        case x86_seg_ss:
+            if ( mode_64bit() && (cpl != 3) && (cpl == sel) )
+        default:
+                break;
+            /* fall through */
+        case x86_seg_cs:
+        case x86_seg_tr:
             goto raise_exn;
+        }
         memset(sreg, 0, sizeof(*sreg));
         sreg->sel = sel;
         return X86EMUL_OKAY;

Comments

Konrad Rzeszutek Wilk Sept. 22, 2016, 10:09 a.m. UTC | #1 
On Thu, Sep 22, 2016 at 12:38:22AM -0600, Jan Beulich wrote:
> Signed-off-by: Jan Beulich <jbeulich@suse.com>

Reviewed-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
> ---
> This goes on top of
> https://lists.xenproject.org/archives/html/xen-devel/2016-09/msg02198.html 
> 
> --- a/xen/arch/x86/x86_emulate/x86_emulate.c
> +++ b/xen/arch/x86/x86_emulate/x86_emulate.c
> @@ -1207,10 +1207,17 @@ protmode_load_seg(
>      /* NULL selector? */
>      if ( (sel & 0xfffc) == 0 )
>      {
> -        if ( (seg == x86_seg_cs) ||
> -             ((seg == x86_seg_ss) &&
> -              (!mode_64bit() || (cpl == 3) || (cpl != sel))) )
> +        switch ( seg )
> +        {
> +        case x86_seg_ss:
> +            if ( mode_64bit() && (cpl != 3) && (cpl == sel) )
> +        default:
> +                break;
> +            /* fall through */
> +        case x86_seg_cs:
> +        case x86_seg_tr:
>              goto raise_exn;
> +        }
>          memset(sreg, 0, sizeof(*sreg));
>          sreg->sel = sel;
>          return X86EMUL_OKAY;
>
Andrew Cooper Sept. 26, 2016, 1:51 p.m. UTC | #2 
On 22/09/16 07:38, Jan Beulich wrote:
> Signed-off-by: Jan Beulich <jbeulich@suse.com>

Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
diff mbox

Patch

--- a/xen/arch/x86/x86_emulate/x86_emulate.c
+++ b/xen/arch/x86/x86_emulate/x86_emulate.c
@@ -1207,10 +1207,17 @@  protmode_load_seg(
     /* NULL selector? */
     if ( (sel & 0xfffc) == 0 )
     {
-        if ( (seg == x86_seg_cs) ||
-             ((seg == x86_seg_ss) &&
-              (!mode_64bit() || (cpl == 3) || (cpl != sel))) )
+        switch ( seg )
+        {
+        case x86_seg_ss:
+            if ( mode_64bit() && (cpl != 3) && (cpl == sel) )
+        default:
+                break;
+            /* fall through */
+        case x86_seg_cs:
+        case x86_seg_tr:
             goto raise_exn;
+        }
         memset(sreg, 0, sizeof(*sreg));
         sreg->sel = sel;
         return X86EMUL_OKAY;