Add limit checking for expand-down data segments. For such segments, the
effective limit specifies the last address that is not allowed to be accessed
within the segment. I.e. offset <= limit means means limit exceeding.
Signed-off-by: Eugene Korenevsky <ekorenevsky@xxxxxxxxx>
---
arch/x86/kvm/vmx.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
index faa05a4..4a4d677 100644
--- a/arch/x86/kvm/vmx.c
+++ b/arch/x86/kvm/vmx.c
@@ -6377,7 +6377,10 @@ static int vmx_protmode_seg_check(struct kvm_vcpu *vcpu,
/* #GP(0)/#SS(0) if the segment is unusable. */
exn = (s->unusable != 0);
/* #GP(0)/#SS(0) if the memory operand is outside the segment limit. */
- exn = exn || (off + mem_op_size - 1 > s->limit);
+ if (!(s->type & 8) && (s->type & 4)) /* expand-down segment? */
+ exn = exn || (off <= s->limit);
+ else
+ exn = exn || (off + mem_op_size - 1 > s->limit);
if (exn) {
kvm_queue_exception_e(vcpu,
seg == VCPU_SREG_SS ?
--
2.1.4
--
To unsubscribe from this list: send the line "unsubscribe kvm" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
