On 20/08/2015 21:37, Eugene Korenevsky wrote: > Add limit checking for expand-down data segments. For such segments, the > effective limit specifies the last address that is not allowed to be accessed > within the segment. I.e. offset <= limit means means limit exceeding. > > Signed-off-by: Eugene Korenevsky <ekorenevsky@xxxxxxxxx> > --- > arch/x86/kvm/vmx.c | 5 ++++- > 1 file changed, 4 insertions(+), 1 deletion(-) > > diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c > index faa05a4..4a4d677 100644 > --- a/arch/x86/kvm/vmx.c > +++ b/arch/x86/kvm/vmx.c > @@ -6377,7 +6377,10 @@ static int vmx_protmode_seg_check(struct kvm_vcpu *vcpu, > /* #GP(0)/#SS(0) if the segment is unusable. */ > exn = (s->unusable != 0); > /* #GP(0)/#SS(0) if the memory operand is outside the segment limit. */ > - exn = exn || (off + mem_op_size - 1 > s->limit); > + if (!(s->type & 8) && (s->type & 4)) /* expand-down segment? */ > + exn = exn || (off <= s->limit); > + else > + exn = exn || (off + mem_op_size - 1 > s->limit); For expand-down segments you also have to check against the size of the segment (48 bits for 64-bit segments and positive addresses, 32 bits for 32-bit segments, 16 bits for 16-bit segments; see __linearize in emulate.c). Paolo -- To unsubscribe from this list: send the line "unsubscribe kvm" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
