KVM: x86: Perform limit checks when assigning EIP
authorNadav Amit <namit@cs.technion.ac.il>
Wed, 19 Nov 2014 15:43:11 +0000 (17:43 +0200)
committerPaolo Bonzini <pbonzini@redhat.com>
Wed, 19 Nov 2014 17:19:22 +0000 (18:19 +0100)
commitd50eaa18039b8b848c2285478d0775335ad5e930
treed8a6a355b05bbf94cc23bef81ed16255c45d2a68
parenta7315d2f3c6c4ff37b27c652dba70939d94d436c
KVM: x86: Perform limit checks when assigning EIP

If branch (e.g., jmp, ret) causes limit violations, since the target IP >
limit, the #GP exception occurs before the branch.  In other words, the RIP
pushed on the stack should be that of the branch and not that of the target.

To do so, we can call __linearize, with new EIP, which also saves us the code
which performs the canonical address checks. On the case of assigning an EIP >=
2^32 (when switching cs.l), we also safe, as __linearize will check the new EIP
does not exceed the limit and would trigger #GP(0) otherwise.

Signed-off-by: Nadav Amit <namit@cs.technion.ac.il>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
arch/x86/kvm/emulate.c