From: Andrew Cooper Date: Tue, 20 Nov 2018 13:58:41 +0000 (+0100) Subject: x86/mm: Don't perform flush after failing to update a guests L1e X-Git-Tag: archive/raspbian/4.14.0+80-gd101b417b7-1+rpi1^2~63^2~2893 X-Git-Url: https://dgit.raspbian.org/%22http://www.example.com/cgi/%22/%22http:/www.example.com/cgi/%22?a=commitdiff_plain;h=6c8d50288722672ecc8e19b0741a31b521d01706;p=xen.git x86/mm: Don't perform flush after failing to update a guests L1e If the L1e update hasn't occured, the flush cannot do anything useful. This skips the potentially expensive vcpumask_to_pcpumask() conversion, and broadcast TLB shootdown. More importantly however, we might be in the error path due to a bad va parameter from the guest, and this should not propagate into the TLB flushing logic. The INVPCID instruction for example raises #GP for a non-canonical address. This is XSA-279. Reported-by: Matthew Daley Signed-off-by: Andrew Cooper Reviewed-by: Jan Beulich --- diff --git a/xen/arch/x86/mm.c b/xen/arch/x86/mm.c index 55f1cb182e..1545baf20b 100644 --- a/xen/arch/x86/mm.c +++ b/xen/arch/x86/mm.c @@ -4152,6 +4152,14 @@ static int __do_update_va_mapping( if ( pl1e ) unmap_domain_page(pl1e); + /* + * Any error at this point means that we haven't change the L1e. Skip the + * flush, as it won't do anything useful. Furthermore, va is guest + * controlled and not necesserily audited by this point. + */ + if ( rc ) + return rc; + switch ( flags & UVMF_FLUSHTYPE_MASK ) { case UVMF_TLB_FLUSH: