On 24/11/2015 23:33, Ben Hutchings wrote:
> 3.2.74-rc1 review patch. If anyone has any objections, please let me know.
>
> ------------------
>
> From: Paolo Bonzini <pbonzini@xxxxxxxxxx>
>
> commit cbdb967af3d54993f5814f1cee0ed311a055377d upstream.
>
> This is needed to avoid the possibility that the guest triggers
> an infinite stream of #DB exceptions (CVE-2015-8104).
>
> VMX is not affected: because it does not save DR6 in the VMCS,
> it already intercepts #DB unconditionally.
>
> Reported-by: Jan Beulich <jbeulich@xxxxxxxx>
> Signed-off-by: Paolo Bonzini <pbonzini@xxxxxxxxxx>
> [bwh: Backported to 3.2: #DB and #BP did not share a function, and there is
> no operation pointer referring to it, so remove update_db_intercept()
> entirely]
This is wrong, you still need to check the BP intercept in the
(incorrectly named as of 3.2) update_db_intercept function.
Something like:
-static void update_db_intercept(struct kvm_vcpu *vcpu)
+static void update_bp_intercept(struct kvm_vcpu *vcpu)
{
struct vcpu_svm *svm = to_svm(vcpu);
- clr_exception_intercept(svm, DB_VECTOR);
clr_exception_intercept(svm, BP_VECTOR);
-
- if (svm->nmi_singlestep)
- set_exception_intercept(svm, DB_VECTOR);
-
if (vcpu->guest_debug & KVM_GUESTDBG_ENABLE) {
- if (vcpu->guest_debug &
- (KVM_GUESTDBG_SINGLESTEP | KVM_GUESTDBG_USE_HW_BP))
- set_exception_intercept(svm, DB_VECTOR);
if (vcpu->guest_debug & KVM_GUESTDBG_USE_SW_BP)
set_exception_intercept(svm, BP_VECTOR);
} else
vcpu->guest_debug = 0;
}
Then the calls in db_interception and enable_nmi_window can be removed,
but the one in svm_guest_debug is important.
Paolo
--
To unsubscribe from this list: send the line "unsubscribe stable" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html