x86/entry: Avoid SMAP violation in compat_create_bounce_frame()
authorAndrew Cooper <andrew.cooper3@citrix.com>
Wed, 15 Jun 2016 17:32:14 +0000 (18:32 +0100)
committerAndrew Cooper <andrew.cooper3@citrix.com>
Tue, 26 Jul 2016 13:07:04 +0000 (14:07 +0100)
commit9f1441487aa215193a7c00fd9cb80b335542465e
tree78ff4c5045df0c2f61a8f3f6c5e39b8eb19ef77d
parente1bff4c2ea3b32464510ac00c320bba28a8dbcca
x86/entry: Avoid SMAP violation in compat_create_bounce_frame()

A 32bit guest kernel might be running on user mappings.
compat_create_bounce_frame() must whitelist its guest accesses to avoid
risking a SMAP violation.

For both variants of create_bounce_frame(), re-blacklist user accesses if
execution exits via an exception table redirection.

This is XSA-183 / CVE-2016-6259

Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Reviewed-by: George Dunlap <george.dunlap@citrix.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>
xen/arch/x86/x86_64/compat/entry.S
xen/arch/x86/x86_64/entry.S