File 5c87b6a2-x86-HVM-dont-crash-guest-in-find_mmio_cache.patch of Package xen
# Commit a43c1dec246bdee484e6a3de001cc6850a107abe
# Date 2019-03-12 14:39:46 +0100
# Author Jan Beulich <jbeulich@suse.com>
# Committer Jan Beulich <jbeulich@suse.com>
x86/HVM: don't crash guest in hvmemul_find_mmio_cache()
Commit 35a61c05ea ("x86emul: adjust handling of AVX2 gathers") builds
upon the fact that the domain will actually survive running out of MMIO
result buffer space. Drop the domain_crash() invocation. Also delay
incrementing of the usage counter, such that the function can't possibly
use/return an out-of-bounds slot/pointer in case execution subsequently
makes it into the function again without a prior reset of state.
Signed-off-by: Jan Beulich <jbeulich@suse.com>
Reviewed-by: Paul Durrant <paul.durrant@citrix.com>
--- a/xen/arch/x86/hvm/emulate.c
+++ b/xen/arch/x86/hvm/emulate.c
@@ -780,12 +780,11 @@ static struct hvm_mmio_cache *hvmemul_fi
return cache;
}
- i = vio->mmio_cache_count++;
+ i = vio->mmio_cache_count;
if( i == ARRAY_SIZE(vio->mmio_cache) )
- {
- domain_crash(current->domain);
return NULL;
- }
+
+ ++vio->mmio_cache_count;
cache = &vio->mmio_cache[i];
memset(cache, 0, sizeof (*cache));