From mboxrd@z Thu Jan 1 00:00:00 1970 From: Eugene Korenevsky Subject: [PATCH 2/5] KVM: nVMX: fix limit check for protected mode Date: Thu, 20 Aug 2015 22:36:58 +0300 Message-ID: <20150820193658.GA3539@unote> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Cc: Paolo Bonzini To: kvm@vger.kernel.org Return-path: Received: from mail-lb0-f178.google.com ([209.85.217.178]:36265 "EHLO mail-lb0-f178.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752228AbbHTThB (ORCPT ); Thu, 20 Aug 2015 15:37:01 -0400 Received: by lbbpu9 with SMTP id pu9so30510853lbb.3 for ; Thu, 20 Aug 2015 12:37:00 -0700 (PDT) Content-Disposition: inline Sender: kvm-owner@vger.kernel.org List-ID: Fix limit checking for all segment types except expand-down data segments. The effective limit is the last address that is allowed to be accessed in the segment. The condition for exceeding the limit should be offset + operand_size - 1 > limit For example, if offset == limit and operand size is one, there is no limit exceeding (limit + 1 - 1 == limit), but if operand size is two, the limit is exceeded (limit + 2 - 1 > limit). Signed-off-by: Eugene Korenevsky --- arch/x86/kvm/vmx.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c index 32d2979..faa05a4 100644 --- a/arch/x86/kvm/vmx.c +++ b/arch/x86/kvm/vmx.c @@ -6377,7 +6377,7 @@ static int vmx_protmode_seg_check(struct kvm_vcpu *vcpu, /* #GP(0)/#SS(0) if the segment is unusable. */ exn = (s->unusable != 0); /* #GP(0)/#SS(0) if the memory operand is outside the segment limit. */ - exn = exn || (off + mem_op_size > s->limit); + exn = exn || (off + mem_op_size - 1 > s->limit); if (exn) { kvm_queue_exception_e(vcpu, seg == VCPU_SREG_SS ? -- 2.1.4