[Xen-changelog] [xen stable-4.5] x86_emulate: split the {reg, mem} union in struct operand

[patchbot@xxxxxxx]

commit 4a69292bc4b70e9a664031349ec611fb34beb1ed
Author:     Tim Deegan <tim@xxxxxxx>
AuthorDate: Tue Apr 21 09:15:07 2015 +0200
Commit:     Jan Beulich <jbeulich@xxxxxxxx>
CommitDate: Tue Apr 21 09:15:07 2015 +0200

    x86_emulate: split the {reg,mem} union in struct operand
    
    In the hopes of making any future errors along the lines of XSA-123
    into clean crashes instead of memory corruption bugs.
    
    Signed-off-by: Tim Deegan <tim@xxxxxxx>
    Reviewed-by: Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
    master commit: dd766684e7c97641bbaf16ee2b0e9add388199b7
    master date: 2015-03-27 16:13:07 +0100
---
 xen/arch/x86/x86_emulate/x86_emulate.c |   27 ++++++++++++++++-----------
 1 files changed, 16 insertions(+), 11 deletions(-)

diff --git a/xen/arch/x86/x86_emulate/x86_emulate.c 
b/xen/arch/x86/x86_emulate/x86_emulate.c
index 8ff31d0..656a06f 100644
--- a/xen/arch/x86/x86_emulate/x86_emulate.c
+++ b/xen/arch/x86/x86_emulate/x86_emulate.c
@@ -325,16 +325,20 @@ struct operand {
         uint32_t orig_bigval[4];
     };
 
-    union {
-        /* OP_REG: Pointer to register field. */
-        unsigned long *reg;
-        /* OP_MEM: Segment and offset. */
-        struct {
-            enum x86_segment seg;
-            unsigned long    off;
-        } mem;
-    };
+    /* OP_REG: Pointer to register field. */
+    unsigned long *reg;
+
+    /* OP_MEM: Segment and offset. */
+    struct {
+        enum x86_segment seg;
+        unsigned long    off;
+    } mem;
 };
+#ifdef __x86_64__
+#define REG_POISON ((unsigned long *) 0x8086000000008086UL) /* non-canonical */
+#else
+#define REG_POISON NULL /* 32-bit builds are for user-space, so NULL is OK. */
+#endif
 
 typedef union {
     uint64_t mmx;
@@ -1460,14 +1464,15 @@ x86_emulate(
     unsigned int op_bytes, def_op_bytes, ad_bytes, def_ad_bytes;
     bool_t lock_prefix = 0;
     int override_seg = -1, rc = X86EMUL_OKAY;
-    struct operand src, dst;
+    struct operand src = { .reg = REG_POISON };
+    struct operand dst = { .reg = REG_POISON };
     enum x86_swint_type swint_type;
     DECLARE_ALIGNED(mmval_t, mmval);
     /*
      * Data operand effective address (usually computed from ModRM).
      * Default is a memory operand relative to segment DS.
      */
-    struct operand ea = { .type = OP_MEM };
+    struct operand ea = { .type = OP_MEM, .reg = REG_POISON };
     ea.mem.seg = x86_seg_ds; /* gcc may reject anon union initializer */
 
     ctxt->retire.byte = 0;
--
generated by git-patchbot for /home/xen/git/xen.git#stable-4.5

_______________________________________________
Xen-changelog mailing list
Xen-changelog@xxxxxxxxxxxxx
http://lists.xensource.com/xen-changelog