x86: avoid calling {svm,vmx}_do_resume()
authorJan Beulich <jbeulich@suse.com>
Tue, 15 Dec 2020 12:41:23 +0000 (13:41 +0100)
committerJan Beulich <jbeulich@suse.com>
Tue, 15 Dec 2020 12:41:23 +0000 (13:41 +0100)
commite6ebd394385db52855d1517cea829ffff68b34b8
tree725a47436b7286de5f0e7e56910554ed5f6ac7df
parent058e469ab4d5cc5959423aafd6ba181dfc310a7f
x86: avoid calling {svm,vmx}_do_resume()

These functions follow the following path: hvm_do_resume() ->
handle_hvm_io_completion() -> hvm_wait_for_io() ->
wait_on_xen_event_channel() -> do_softirq() -> schedule() ->
sched_context_switch() -> continue_running() and hence may
recursively invoke themselves. If this ends up happening a couple of
times, a stack overflow would result.

Prevent this by also resetting the stack at the
->arch.ctxt_switch->tail() invocations (in both places for consistency)
and thus jumping to the functions instead of calling them.

This is XSA-348 / CVE-2020-29566.

Reported-by: Julien Grall <jgrall@amazon.com>
Signed-off-by: Jan Beulich <jbeulich@suse.com>
Reviewed-by: Juergen Gross <jgross@suse.com>
xen/arch/x86/domain.c
xen/arch/x86/hvm/svm/svm.c
xen/arch/x86/hvm/vmx/vmcs.c
xen/arch/x86/pv/domain.c
xen/include/asm-x86/current.h
xen/include/asm-x86/domain.h
xen/include/asm-x86/hvm/vmx/vmx.h