From dcfd9a5eadedc71d8546286b881bba7db152207a Mon Sep 17 00:00:00 2001 From: Jan Beulich Date: Mon, 26 Sep 2016 17:27:06 +0200 Subject: [PATCH] x86emul: don't allow null selector for LTR Signed-off-by: Jan Beulich Reviewed-by: Konrad Rzeszutek Wilk Reviewed-by: Andrew Cooper --- xen/arch/x86/x86_emulate/x86_emulate.c | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) diff --git a/xen/arch/x86/x86_emulate/x86_emulate.c b/xen/arch/x86/x86_emulate/x86_emulate.c index 9c76c2e032..b22ede659b 100644 --- a/xen/arch/x86/x86_emulate/x86_emulate.c +++ b/xen/arch/x86/x86_emulate/x86_emulate.c @@ -1207,10 +1207,17 @@ protmode_load_seg( /* NULL selector? */ if ( (sel & 0xfffc) == 0 ) { - if ( (seg == x86_seg_cs) || - ((seg == x86_seg_ss) && - (!mode_64bit() || (cpl == 3) || (cpl != sel))) ) + switch ( seg ) + { + case x86_seg_ss: + if ( mode_64bit() && (cpl != 3) && (cpl == sel) ) + default: + break; + /* fall through */ + case x86_seg_cs: + case x86_seg_tr: goto raise_exn; + } memset(sreg, 0, sizeof(*sreg)); sreg->sel = sel; return X86EMUL_OKAY; -- 2.30.2