x86: avoid calling {svm,vmx}_do_resume()
authorJan Beulich <jbeulich@suse.com>
Tue, 15 Dec 2020 11:30:01 +0000 (12:30 +0100)
committerHans van Kranenburg <hans@knorrie.org>
Tue, 15 Dec 2020 11:30:01 +0000 (12:30 +0100)
commitf376a1bed204a74bbb86a3e3e9195a3f08bb55a0
tree00e32b710f45a0a80b9fc594682900f3a4df672a
parent425e7ea4ae936fe8a041823431bcafb69275db93
x86: avoid calling {svm,vmx}_do_resume()

These functions follow the following path: hvm_do_resume() ->
handle_hvm_io_completion() -> hvm_wait_for_io() ->
wait_on_xen_event_channel() -> do_softirq() -> schedule() ->
sched_context_switch() -> continue_running() and hence may
recursively invoke themselves. If this ends up happening a couple of
times, a stack overflow would result.

Prevent this by also resetting the stack at the
->arch.ctxt_switch->tail() invocations (in both places for consistency)
and thus jumping to the functions instead of calling them.

This is XSA-348 / CVE-2020-29566.

Signed-off-by: Jan Beulich <jbeulich@suse.com>
Reviewed-by: Juergen Gross <jgross@suse.com>
xen/arch/x86/domain.c
xen/arch/x86/hvm/svm/svm.c
xen/arch/x86/hvm/vmx/vmcs.c
xen/arch/x86/pv/domain.c
xen/include/asm-x86/current.h
xen/include/asm-x86/domain.h
xen/include/asm-x86/hvm/vmx/vmx.h