Validate the segment selectors passed to arch_set_info_guest().

Signed-off-by: Ian Campbell <Ian.Campbell@XenSource.com>

diff --git a/xen/arch/x86/domain.c b/xen/arch/x86/domain.c
index 4265d3f8bbdf7a226c3dfd8e8eaa6d4af18b329a..1c083fcb67868d336c9217bdca54fe4df0e0991b 100644 (file)
--- a/xen/arch/x86/domain.c
+++ b/xen/arch/x86/domain.c
@@ -356,9 +356,15 @@ int arch_set_info_guest(
      */
     if ( !(c->flags & VGCF_HVM_GUEST) )
     {
-        if ( ((c->user_regs.cs & 3) == 0) ||
-             ((c->user_regs.ss & 3) == 0) )
+        if ( ((c->user_regs.ss & 3) == 0) ||
+             !VALID_CODESEL(c->user_regs.cs) ||
+             !VALID_CODESEL(c->event_callback_cs) ||
+             !VALID_CODESEL(c->failsafe_callback_cs) )
             return -EINVAL;
+
+        for ( i = 0; i < 256; i++ )
+            if ( !VALID_CODESEL(c->trap_ctxt[i].cs) )
+                return -EINVAL;
     }
     else if ( !hvm_enabled )
       return -EINVAL;