From mboxrd@z Thu Jan 1 00:00:00 1970 From: Eugene Korenevsky Subject: [PATCH 3/5] KVM: nVMX: add limit check for expand-down segments Date: Thu, 20 Aug 2015 22:37:39 +0300 Message-ID: <20150820193739.GA3555@unote> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Cc: Paolo Bonzini To: kvm@vger.kernel.org Return-path: Received: from mail-la0-f41.google.com ([209.85.215.41]:33674 "EHLO mail-la0-f41.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752492AbbHTThm (ORCPT ); Thu, 20 Aug 2015 15:37:42 -0400 Received: by lalv9 with SMTP id v9so28911278lal.0 for ; Thu, 20 Aug 2015 12:37:40 -0700 (PDT) Content-Disposition: inline Sender: kvm-owner@vger.kernel.org List-ID: Add limit checking for expand-down data segments. For such segments, the effective limit specifies the last address that is not allowed to be accessed within the segment. I.e. offset <= limit means means limit exceeding. Signed-off-by: Eugene Korenevsky --- arch/x86/kvm/vmx.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c index faa05a4..4a4d677 100644 --- a/arch/x86/kvm/vmx.c +++ b/arch/x86/kvm/vmx.c @@ -6377,7 +6377,10 @@ static int vmx_protmode_seg_check(struct kvm_vcpu *vcpu, /* #GP(0)/#SS(0) if the segment is unusable. */ exn = (s->unusable != 0); /* #GP(0)/#SS(0) if the memory operand is outside the segment limit. */ - exn = exn || (off + mem_op_size - 1 > s->limit); + if (!(s->type & 8) && (s->type & 4)) /* expand-down segment? */ + exn = exn || (off <= s->limit); + else + exn = exn || (off + mem_op_size - 1 > s->limit); if (exn) { kvm_queue_exception_e(vcpu, seg == VCPU_SREG_SS ? -- 2.1.4