From: Andrew Cooper Date: Tue, 20 Nov 2018 14:33:16 +0000 (+0100) Subject: x86/mm: Don't perform flush after failing to update a guests L1e X-Git-Tag: archive/raspbian/4.11.1-1+rpi1^2~53^2~4 X-Git-Url: https://dgit.raspbian.org/?a=commitdiff_plain;h=e738850aaf88f201997b5d05adf85dffb54c0c10;p=xen.git x86/mm: Don't perform flush after failing to update a guests L1e If the L1e update hasn't occured, the flush cannot do anything useful. This skips the potentially expensive vcpumask_to_pcpumask() conversion, and broadcast TLB shootdown. More importantly however, we might be in the error path due to a bad va parameter from the guest, and this should not propagate into the TLB flushing logic. The INVPCID instruction for example raises #GP for a non-canonical address. This is XSA-279. Reported-by: Matthew Daley Signed-off-by: Andrew Cooper Reviewed-by: Jan Beulich master commit: 6c8d50288722672ecc8e19b0741a31b521d01706 master date: 2018-11-20 14:58:41 +0100 --- diff --git a/xen/arch/x86/mm.c b/xen/arch/x86/mm.c index 9d29f3127d..79f257975c 100644 --- a/xen/arch/x86/mm.c +++ b/xen/arch/x86/mm.c @@ -4089,6 +4089,14 @@ static int __do_update_va_mapping( if ( pl1e ) unmap_domain_page(pl1e); + /* + * Any error at this point means that we haven't change the L1e. Skip the + * flush, as it won't do anything useful. Furthermore, va is guest + * controlled and not necesserily audited by this point. + */ + if ( rc ) + return rc; + switch ( flags & UVMF_FLUSHTYPE_MASK ) { case UVMF_TLB_FLUSH: