From 0d027c01cd36b8cff727c78d2e40d334ba9895a8 Mon Sep 17 00:00:00 2001 From: Rusty Russell Date: Thu, 9 Aug 2007 20:57:13 +1000 Subject: lguest: Fix Malicious Guest GDT Host Crash If a Guest makes hypercall which sets a GDT entry to not present, we currently set any segment registers using that GDT entry to 0. Unfortunately, this is not sufficient: there are other ways of altering GDT entries which will cause a fault. The correct solution to do what Linux does: let them set any GDT value they want and handle the #GP when popping causes a fault. This has the added benefit of making our Switcher slightly more robust in the case of any other bugs which cause it to fault. We kill the Guest if it causes a fault in the Switcher: it's the Guest's responsibility to make sure it's not using segments when it changes them. Signed-off-by: Rusty Russell Signed-off-by: Linus Torvalds --- drivers/lguest/core.c | 5 +++++ 1 file changed, 5 insertions(+) (limited to 'drivers/lguest/core.c') diff --git a/drivers/lguest/core.c b/drivers/lguest/core.c index 0a46e8837d9..4a315f08a56 100644 --- a/drivers/lguest/core.c +++ b/drivers/lguest/core.c @@ -453,6 +453,11 @@ static void run_guest_once(struct lguest *lg, struct lguest_pages *pages) * lguest_pages". */ copy_in_guest_info(lg, pages); + /* Set the trap number to 256 (impossible value). If we fault while + * switching to the Guest (bad segment registers or bug), this will + * cause us to abort the Guest. */ + lg->regs->trapnum = 256; + /* Now: we push the "eflags" register on the stack, then do an "lcall". * This is how we change from using the kernel code segment to using * the dedicated lguest code segment, as well as jumping into the -- cgit v1.2.3