x86: avoid calling {svm,vmx}_do_resume()
authorJan Beulich <jbeulich@suse.com>
Tue, 15 Dec 2020 13:13:56 +0000 (14:13 +0100)
committerJan Beulich <jbeulich@suse.com>
Tue, 15 Dec 2020 13:13:56 +0000 (14:13 +0100)
commitd8f08a44bc8da1401a9731667daecdb9b213c073
tree3192821a23e15687e81e2252c813c3e90b07e141
parent5174e4202e1fdc145a661e6ad1762b9e1acdb27c
x86: avoid calling {svm,vmx}_do_resume()

These functions follow the following path: hvm_do_resume() ->
handle_hvm_io_completion() -> hvm_wait_for_io() ->
wait_on_xen_event_channel() -> do_softirq() -> schedule() ->
sched_context_switch() -> continue_running() and hence may
recursively invoke themselves. If this ends up happening a couple of
times, a stack overflow would result.

Prevent this by also resetting the stack at the
->arch.ctxt_switch->tail() invocations (in both places for consistency)
and thus jumping to the functions instead of calling them.

This is XSA-348 / CVE-2020-29566.

Reported-by: Julien Grall <jgrall@amazon.com>
Signed-off-by: Jan Beulich <jbeulich@suse.com>
Reviewed-by: Juergen Gross <jgross@suse.com>
master commit: e6ebd394385db52855d1517cea829ffff68b34b8
master date: 2020-12-15 13:41:23 +0100
xen/arch/x86/domain.c
xen/arch/x86/hvm/svm/svm.c
xen/arch/x86/hvm/vmx/vmcs.c
xen/arch/x86/pv/domain.c
xen/include/asm-x86/current.h
xen/include/asm-x86/domain.h
xen/include/asm-x86/hvm/vmx/vmx.h