diff options
| author |   Paolo Bonzini <pbonzini@redhat.com> | 2017-06-07 15:13:14 +0200 |
|---|---|---|
| committer |   Radim Krčmář <rkrcmar@redhat.com> | 2017-06-22 16:13:29 +0200 |
| commit | c8401dda2f0a00cd25c0af6a95ed50e478d25de4 (patch) | |
| tree | fbd14d28d00e86e4b3cbb1f75390052de23bd73e /arch/x86/include | |
| parent | Merge tag 'kvm-s390-master-4.12-2' of git://git.kernel.org/pub/scm/linux/kernel/git/kvms390/linux (diff) | |
| download | linux-dev-c8401dda2f0a00cd25c0af6a95ed50e478d25de4.tar.xz linux-dev-c8401dda2f0a00cd25c0af6a95ed50e478d25de4.zip | |
KVM: x86: fix singlestepping over syscall
TF is handled a bit differently for syscall and sysret, compared
to the other instructions: TF is checked after the instruction completes,
so that the OS can disable #DB at a syscall by adding TF to FMASK.
When the sysret is executed the #DB is taken "as if" the syscall insn
just completed.
KVM emulates syscall so that it can trap 32-bit syscall on Intel processors.
Fix the behavior, otherwise you could get #DB on a user stack which is not
nice. This does not affect Linux guests, as they use an IST or task gate
for #DB.
This fixes CVE-2017-7518.
Cc: stable@vger.kernel.org
Reported-by: Andy Lutomirski <luto@kernel.org>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Radim Krčmář <rkrcmar@redhat.com>
Diffstat (limited to 'arch/x86/include')
| -rw-r--r-- | arch/x86/include/asm/kvm_emulate.h | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/arch/x86/include/asm/kvm_emulate.h b/arch/x86/include/asm/kvm_emulate.h index 055962615779..722d0e568863 100644 --- a/arch/x86/include/asm/kvm_emulate.h +++ b/arch/x86/include/asm/kvm_emulate.h @@ -296,6 +296,7 @@ struct x86_emulate_ctxt { bool perm_ok; /* do not check permissions if true */ bool ud; /* inject an #UD if host doesn't support insn */ + bool tf; /* TF value before instruction (after for syscall/sysret) */ bool have_exception; struct x86_exception exception; |