From 3f5490d7e442db3dc65d784ee3c087f7e41f5a06 Mon Sep 17 00:00:00 2001 From: Jan Beulich Date: Fri, 3 May 2019 11:04:32 +0200 Subject: [PATCH] x86/HVM: don't crash guest in hvmemul_find_mmio_cache() Commit 35a61c05ea ("x86emul: adjust handling of AVX2 gathers") builds upon the fact that the domain will actually survive running out of MMIO result buffer space. Drop the domain_crash() invocation. Also delay incrementing of the usage counter, such that the function can't possibly use/return an out-of-bounds slot/pointer in case execution subsequently makes it into the function again without a prior reset of state. Signed-off-by: Jan Beulich Reviewed-by: Paul Durrant master commit: a43c1dec246bdee484e6a3de001cc6850a107abe master date: 2019-03-12 14:39:46 +0100 --- xen/arch/x86/hvm/emulate.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/xen/arch/x86/hvm/emulate.c b/xen/arch/x86/hvm/emulate.c index 3bf4cfe9f0..fae93bc748 100644 --- a/xen/arch/x86/hvm/emulate.c +++ b/xen/arch/x86/hvm/emulate.c @@ -945,12 +945,11 @@ static struct hvm_mmio_cache *hvmemul_find_mmio_cache( return cache; } - i = vio->mmio_cache_count++; + i = vio->mmio_cache_count; if( i == ARRAY_SIZE(vio->mmio_cache) ) - { - domain_crash(current->domain); return NULL; - } + + ++vio->mmio_cache_count; cache = &vio->mmio_cache[i]; memset(cache, 0, sizeof (*cache)); -- 2.39.5