On 2015/1/28 16:49, Nadav Amit wrote:
> There is a bug in this patch, so please include
> 7e46dddd6f6cd5dbf3c7bd04a7e75d19475ac9f2 ("KVM: x86: Fix far-jump to
> non-canonical check”) as well.Applied. Thanks! > > Regards, > Nadav > > l...@kernel.org wrote: > >> From: Nadav Amit <na...@cs.technion.ac.il> >> >> 3.4.106-rc1 review patch. If anyone has any objections, please let me know. >> >> ------------------ >> >> >> commit 234f3ce485d54017f15cf5e0699cff4100121601 upstream. >> >> Before changing rip (during jmp, call, ret, etc.) the target should be >> asserted >> to be canonical one, as real CPUs do. During sysret, both target rsp and rip >> should be canonical. If any of these values is noncanonical, a #GP exception >> should occur. The exception to this rule are syscall and sysenter >> instructions >> in which the assigned rip is checked during the assignment to the relevant >> MSRs. >> >> This patch fixes the emulator to behave as real CPUs do for near branches. >> Far branches are handled by the next patch. >> >> This fixes CVE-2014-3647. >> >> Signed-off-by: Nadav Amit <na...@cs.technion.ac.il> >> Signed-off-by: Paolo Bonzini <pbonz...@redhat.com> >> [lizf: Backported to 3.4: >> - adjust context >> - use ctxt->regs rather than reg_read() and reg_write()] >> Signed-off-by: Zefan Li <lize...@huawei.com> -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
