1 files changed, 55 insertions, 0 deletions
diff --git a/main/xen/xsa75-4.3-unstable.patch b/main/xen/xsa75-4.3-unstable.patch
new file mode 100644
index 0000000000..b3724c35d4
--- /dev/null
+++ b/main/xen/xsa75-4.3-unstable.patch
@@ -0,0 +1,55 @@
+nested VMX: VMLANUCH/VMRESUME emulation must check permission first thing
+
+Otherwise uninitialized data may be used, leading to crashes.
+
+This is XSA-75.
+
+Reported-and-tested-by: Jeff Zimmerman <Jeff_Zimmerman@McAfee.com>
+Signed-off-by: Jan Beulich <jbeulich@suse.com>
+Reviewed-and-tested-by: Andrew Cooper <andrew.cooper3@citrix.com>
+
+--- a/xen/arch/x86/hvm/vmx/vvmx.c
++++ b/xen/arch/x86/hvm/vmx/vvmx.c
+@@ -1509,15 +1509,10 @@ static void clear_vvmcs_launched(struct 
+     }
+ }
+ 
+-int nvmx_vmresume(struct vcpu *v, struct cpu_user_regs *regs)
++static int nvmx_vmresume(struct vcpu *v, struct cpu_user_regs *regs)
+ {
+     struct nestedvmx *nvmx = &vcpu_2_nvmx(v);
+     struct nestedvcpu *nvcpu = &vcpu_nestedhvm(v);
+-    int rc;
+-
+-    rc = vmx_inst_check_privilege(regs, 0);
+-    if ( rc != X86EMUL_OKAY )
+-        return rc;
+ 
+     /* check VMCS is valid and IO BITMAP is set */
+     if ( (nvcpu->nv_vvmcxaddr != VMCX_EADDR) &&
+@@ -1536,6 +1531,10 @@ int nvmx_handle_vmresume(struct cpu_user
+     struct vcpu *v = current;
+     struct nestedvcpu *nvcpu = &vcpu_nestedhvm(v);
+     struct nestedvmx *nvmx = &vcpu_2_nvmx(v);
++    int rc = vmx_inst_check_privilege(regs, 0);
++
++    if ( rc != X86EMUL_OKAY )
++        return rc;
+ 
+     if ( vcpu_nestedhvm(v).nv_vvmcxaddr == VMCX_EADDR )
+     {
+@@ -1555,10 +1554,13 @@ int nvmx_handle_vmresume(struct cpu_user
+ int nvmx_handle_vmlaunch(struct cpu_user_regs *regs)
+ {
+     bool_t launched;
+-    int rc;
+     struct vcpu *v = current;
+     struct nestedvcpu *nvcpu = &vcpu_nestedhvm(v);
+     struct nestedvmx *nvmx = &vcpu_2_nvmx(v);
++    int rc = vmx_inst_check_privilege(regs, 0);
++
++    if ( rc != X86EMUL_OKAY )
++        return rc;
+ 
+     if ( vcpu_nestedhvm(v).nv_vvmcxaddr == VMCX_EADDR )
+     {