x86/32on64: don't allow recursive page tables from L3
authorJan Beulich <jbeulich@suse.com>
Thu, 8 Sep 2016 12:14:53 +0000 (14:14 +0200)
committerJan Beulich <jbeulich@suse.com>
Thu, 8 Sep 2016 12:14:53 +0000 (14:14 +0200)
commitc844d637d92a75854ea5c8d4e5ca34302a9f623c
treef02858f169e2ee0ad759f703248ce99c0668b09f
parentf8b4d961d5661d2edfaccadf66988596bfbc44c6
x86/32on64: don't allow recursive page tables from L3

L3 entries are special in PAE mode, and hence can't reasonably be used
for setting up recursive (and hence linear) page table mappings. Since
abuse is possible when the guest in fact gets run on 4-level page
tables, this needs to be excluded explicitly.

This is XSA-185 / CVE-2016-7092.

Reported-by: Jérémie Boutoille <jboutoille@ext.quarkslab.com>
Reported-by: "栾尚聪(好风)" <shangcong.lsc@alibaba-inc.com>
Signed-off-by: Jan Beulich <jbeulich@suse.com>
Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
xen/arch/x86/mm.c