diff options
Diffstat (limited to 'sysutils/xenkernel41/patches/patch-XSA-200')
| -rw-r--r-- | sysutils/xenkernel41/patches/patch-XSA-200 | 57 |
1 files changed, 57 insertions, 0 deletions
diff --git a/sysutils/xenkernel41/patches/patch-XSA-200 b/sysutils/xenkernel41/patches/patch-XSA-200 new file mode 100644 index 00000000000..8ffb7246c60 --- /dev/null +++ b/sysutils/xenkernel41/patches/patch-XSA-200 @@ -0,0 +1,57 @@ +$NetBSD: patch-XSA-200,v 1.1 2016/12/20 10:22:28 bouyer Exp $ + +From: Jan Beulich <jbeulich@suse.com> +Subject: x86emul: CMPXCHG8B ignores operand size prefix + +Otherwise besides mis-handling the instruction, the comparison failure +case would result in uninitialized stack data being handed back to the +guest in rDX:rAX (32 bits leaked for 32-bit guests, 96 bits for 64-bit +ones). + +This is XSA-200. + +Signed-off-by: Jan Beulich <jbeulich@suse.com> + +--- tools/tests/x86_emulator/test_x86_emulator.c.orig ++++ tools/tests/x86_emulator/test_x86_emulator.c +@@ -429,6 +429,24 @@ int main(int argc, char **argv) + goto fail; + printf("okay\n"); + ++ printf("%-40s", "Testing cmpxchg8b (%edi) [opsize]..."); ++ instr[0] = 0x66; instr[1] = 0x0f; instr[2] = 0xc7; instr[3] = 0x0f; ++ res[0] = 0x12345678; ++ res[1] = 0x87654321; ++ regs.eflags = 0x200; ++ regs.eip = (unsigned long)&instr[0]; ++ regs.edi = (unsigned long)res; ++ rc = x86_emulate(&ctxt, &emulops); ++ if ( (rc != X86EMUL_OKAY) || ++ (res[0] != 0x12345678) || ++ (res[1] != 0x87654321) || ++ (regs.eax != 0x12345678) || ++ (regs.edx != 0x87654321) || ++ ((regs.eflags&0x240) != 0x200) || ++ (regs.eip != (unsigned long)&instr[4]) ) ++ goto fail; ++ printf("okay\n"); ++ + printf("%-40s", "Testing movsxbd (%%eax),%%ecx..."); + instr[0] = 0x0f; instr[1] = 0xbe; instr[2] = 0x08; + regs.eflags = 0x200; +--- ./xen/arch/x86/x86_emulate/x86_emulate.c.orig 2016-12-19 21:54:25.000000000 +0100 ++++ ./xen/arch/x86/x86_emulate/x86_emulate.c 2016-12-19 22:00:32.000000000 +0100 +@@ -4183,7 +4183,12 @@ + + generate_exception_if((modrm_reg & 7) != 1, EXC_UD, -1); + generate_exception_if(ea.type != OP_MEM, EXC_UD, -1); +- op_bytes *= 2; ++ if ( op_bytes == 8 ) ++ { ++ /* vcpu_must_have_cx16() XXX doens't exists */ ++ op_bytes = 16; ++ } else ++ op_bytes = 8; + + /* Get actual old value. */ + for ( i = 0; i < (op_bytes/sizeof(long)); i++ ) |