Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752422AbbKYLbk (ORCPT ); Wed, 25 Nov 2015 06:31:40 -0500 Received: from mx1.redhat.com ([209.132.183.28]:38170 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751800AbbKYLbi (ORCPT ); Wed, 25 Nov 2015 06:31:38 -0500 Subject: Re: [PATCH 3.2 41/52] KVM: svm: unconditionally intercept #DB To: Ben Hutchings , linux-kernel@vger.kernel.org, stable@vger.kernel.org References: Cc: akpm@linux-foundation.org, Jan Beulich From: Paolo Bonzini Message-ID: <56559C15.6040103@redhat.com> Date: Wed, 25 Nov 2015 12:31:33 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:38.0) Gecko/20100101 Thunderbird/38.3.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=windows-1252 Content-Transfer-Encoding: 7bit Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1903 Lines: 59 On 24/11/2015 23:33, Ben Hutchings wrote: > 3.2.74-rc1 review patch. If anyone has any objections, please let me know. > > ------------------ > > From: Paolo Bonzini > > commit cbdb967af3d54993f5814f1cee0ed311a055377d upstream. > > This is needed to avoid the possibility that the guest triggers > an infinite stream of #DB exceptions (CVE-2015-8104). > > VMX is not affected: because it does not save DR6 in the VMCS, > it already intercepts #DB unconditionally. > > Reported-by: Jan Beulich > Signed-off-by: Paolo Bonzini > [bwh: Backported to 3.2: #DB and #BP did not share a function, and there is > no operation pointer referring to it, so remove update_db_intercept() > entirely] This is wrong, you still need to check the BP intercept in the (incorrectly named as of 3.2) update_db_intercept function. Something like: -static void update_db_intercept(struct kvm_vcpu *vcpu) +static void update_bp_intercept(struct kvm_vcpu *vcpu) { struct vcpu_svm *svm = to_svm(vcpu); - clr_exception_intercept(svm, DB_VECTOR); clr_exception_intercept(svm, BP_VECTOR); - - if (svm->nmi_singlestep) - set_exception_intercept(svm, DB_VECTOR); - if (vcpu->guest_debug & KVM_GUESTDBG_ENABLE) { - if (vcpu->guest_debug & - (KVM_GUESTDBG_SINGLESTEP | KVM_GUESTDBG_USE_HW_BP)) - set_exception_intercept(svm, DB_VECTOR); if (vcpu->guest_debug & KVM_GUESTDBG_USE_SW_BP) set_exception_intercept(svm, BP_VECTOR); } else vcpu->guest_debug = 0; } Then the calls in db_interception and enable_nmi_window can be removed, but the one in svm_guest_debug is important. Paolo -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/