e95e9b88ba
In do_interrupt64(), when interrupt stack table(ist) is enabled and the the target code segment is conforming(e2 & DESC_C_MASK), the old implementation always set new CPL to 0, and SS.RPL to 0. This is incorrect for when CPL3 code access a CPL0 conforming code segment, the CPL should remain unchanged. Otherwise higher privileged code can be compromised. The patch fix this for always set dpl = cpl when the target code segment is conforming, and modify the last parameter `flags`, which contains correct new CPL, in cpu_x86_load_seg_cache(). Signed-off-by: Wu Xiang <willx8@gmail.com> Message-Id: <20170621142152.GA18094@wxdeubuntu.ipads-lab.se.sjtu.edu.cn> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> |
||
---|---|---|
.. | ||
alpha | ||
arm | ||
cris | ||
hppa | ||
i386 | ||
lm32 | ||
m68k | ||
microblaze | ||
mips | ||
moxie | ||
nios2 | ||
openrisc | ||
ppc | ||
s390x | ||
sh4 | ||
sparc | ||
tilegx | ||
tricore | ||
unicore32 | ||
xtensa |