diff options
| author | Nadav Amit <namit@cs.technion.ac.il> | 2015-01-01 23:11:11 +0200 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2015-04-29 10:31:53 +0200 |
| commit | ce5996929f2df50b1e37037a5a78d1269fbb5309 (patch) | |
| tree | bb5c00d88a9a3ff6c6b49ba7e2443fa4533cd610 /fs/exportfs/expfs.c | |
| parent | efbf300ed821a533c3af71b1b122227febc28142 (diff) | |
| download | lwn-ce5996929f2df50b1e37037a5a78d1269fbb5309.tar.gz lwn-ce5996929f2df50b1e37037a5a78d1269fbb5309.zip | |
KVM: x86: SYSENTER emulation is broken
commit f3747379accba8e95d70cec0eae0582c8c182050 upstream.
SYSENTER emulation is broken in several ways:
1. It misses the case of 16-bit code segments completely (CVE-2015-0239).
2. MSR_IA32_SYSENTER_CS is checked in 64-bit mode incorrectly (bits 0 and 1 can
still be set without causing #GP).
3. MSR_IA32_SYSENTER_EIP and MSR_IA32_SYSENTER_ESP are not masked in
legacy-mode.
4. There is some unneeded code.
Fix it.
Signed-off-by: Nadav Amit <namit@cs.technion.ac.il>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
[zhangzhiqiang: backport to 3.10:
- adjust context
- in 3.10 context "ctxt->eflags &= ~(EFLG_VM | EFLG_IF | EFLG_RF)" is replaced by
"ctxt->eflags &= ~(EFLG_VM | EFLG_IF)" in upstream, which was changed by another commit.
- After the above adjustments, becomes same to the original patch:
https://github.com/torvalds/linux/commit/f3747379accba8e95d70cec0eae0582c8c182050
]
Signed-off-by: Zhiqiang Zhang <zhangzhiqiang.zhang@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'fs/exportfs/expfs.c')
0 files changed, 0 insertions, 0 deletions