]> xenbits.xensource.com Git - people/dariof/xen.git/commit
x86/hvm: Don't corrupt the HVM context stream when writing the MSR record 4.10.0-rc6
authorAndrew Cooper <andrew.cooper3@citrix.com>
Thu, 16 Nov 2017 21:34:02 +0000 (21:34 +0000)
committerAndrew Cooper <andrew.cooper3@citrix.com>
Tue, 21 Nov 2017 11:19:02 +0000 (11:19 +0000)
commitd2f86bf604698806d311cc251c1b66fbb752673c
treea2fe2cf4000b426e0a7933b71ade7a27f8551975
parentf1a0a8c3fe2fb37c77ec1fe43618feef412427b5
x86/hvm: Don't corrupt the HVM context stream when writing the MSR record

Ever since it was introduced in c/s bd1f0b45ff, hvm_save_cpu_msrs() has had a
bug whereby it corrupts the HVM context stream if some, but fewer than the
maximum number of MSRs are written.

_hvm_init_entry() creates an hvm_save_descriptor with length for
msr_count_max, but in the case that we write fewer than max, h->cur only moves
forward by the amount of space used, causing the subsequent
hvm_save_descriptor to be written within the bounds of the previous one.

To resolve this, reduce the length reported by the descriptor to match the
actual number of bytes used.

A typical failure on the destination side looks like:

    (XEN) HVM4 restore: CPU_MSR 0
    (XEN) HVM4.0 restore: not enough data left to read 56 MSR bytes
    (XEN) HVM4 restore: failed to load entry 20/0

Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Reviewed-by: Wei Liu <wei.liu2@citrix.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>
Release-acked-by: Julien Grall <julien.grall@linaro.org>
xen/arch/x86/hvm/hvm.c