Eric Lee / smarc-ti-linux-kernel

Download as
Browse Code ยป

Commit ab646f54f4fd1a8b9671b8707f0739fdd28ce2b1

Authored by Nadav Amit
Committed by Paolo Bonzini
1 parent 78051e3b7e
Exists in ti-lsk-linux-4.1.y and in 10 other branches dlt-processor-sdk-linux-03.00.00.04, processor-sdk-linux-02.00.01, smarc-ti-lsk-linux-4.1.y, smarct3x-processor-sdk-04.01.00.06, smarct3x-processor-sdk-linux-02.00.01, smarct3x-processor-sdk-linux-03.00.00.04, smarct4x-800-processor-sdk-linux-02.00.01, smarct4x-processor-sdk-04.01.00.06, smarct4x-processor-sdk-linux-02.00.01, smarct4x-processor-sdk-linux-03.00.00.04

KVM: x86: em_ret_far overrides cpl 

commit d50eaa18039b ("KVM: x86: Perform limit checks when assigning EIP")
mistakenly used zero as cpl on em_ret_far. Use the actual one.

Fixes: d50eaa18039b8b848c2285478d0775335ad5e930
Cc: stable@vger.kernel.org
Signed-off-by: Nadav Amit <namit@cs.technion.ac.il>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

Showing 1 changed file with 1 additions and 1 deletions Side-by-side Diff

arch/x86/kvm/emulate.c
Diff comments   View file @ ab646f5
... ... @@ -2130,7 +2130,7 @@
2130 2130 /* Outer-privilege level return is not implemented */
2131 2131 if (ctxt->mode >= X86EMUL_MODE_PROT16 && (cs & 3) > cpl)
2132 2132 return X86EMUL_UNHANDLEABLE;
2133   - rc = __load_segment_descriptor(ctxt, (u16)cs, VCPU_SREG_CS, 0, false,
  2133 + rc = __load_segment_descriptor(ctxt, (u16)cs, VCPU_SREG_CS, cpl, false,
2134 2134 &new_desc);
2135 2135 if (rc != X86EMUL_CONTINUE)
2136 2136 return rc;