x86: guard against undue super page PTE creation
authorJan Beulich <jbeulich@suse.com>
Thu, 29 Oct 2015 12:48:09 +0000 (13:48 +0100)
committerIan Campbell <ijc@debian.org>
Tue, 9 Feb 2016 16:41:16 +0000 (16:41 +0000)
commit2708f7ba908f917f0f6a527487326227005d1cd7
tree188aebdb8409b6fe055eb7ec92ebc960d21bb008
parentfc12722ee7c5fc2e776c768e2c9fbb10586d61a1
x86: guard against undue super page PTE creation

When optional super page support got added (commit bd1cd81d64 "x86: PV
support for hugepages"), two adjustments were missed: mod_l2_entry()
needs to consider the PSE and RW bits when deciding whether to use the
fast path, and the PSE bit must not be removed from L2_DISALLOW_MASK
unconditionally.

This is CVE-2015-7835 / XSA-148.

Reported-by: "栾尚聪(好风)" <shangcong.lsc@alibaba-inc.com>
Signed-off-by: Jan Beulich <jbeulich@suse.com>
Reviewed-by: Tim Deegan <tim@xen.org>
master commit: fe360c90ea13f309ef78810f1a2b92f2ae3b30b8
master date: 2015-10-29 13:35:07 +0100

(cherry picked from commit 2d094bd87072e26ac29b07917d31fcbf13892288)

Patch-Name: CVE-2015-7835.diff

Gbp-Pq: Name CVE-2015-7835.diff
xen/arch/x86/mm.c