[linux] 02/02: [x86] KVM: svm: unconditionally intercept #DB (CVE-2015-8104)

[debian-kernel at lists.debian.org]

This is an automated email from the git hooks/post-receive script.

benh pushed a commit to branch wheezy
in repository linux.

commit 0f8f47985bdba7ad63397ed12c928d8e8da39245
Author: Ben Hutchings <ben at decadent.org.uk>
Date:   Tue Nov 17 16:32:35 2015 +0000

    [x86] KVM: svm: unconditionally intercept #DB (CVE-2015-8104)
---
 debian/changelog                                   |  1 +
 .../x86/kvm-svm-unconditionally-intercept-db.patch | 83 ++++++++++++++++++++++
 debian/patches/series                              |  1 +
 3 files changed, 85 insertions(+)

diff --git a/debian/changelog b/debian/changelog
index a1b76da..7046f6a 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -149,6 +149,7 @@ linux (3.2.73-1) UNRELEASED; urgency=medium
   * isdn_ppp: Add checks for allocation failure in isdn_ppp_open()
   * ppp, slip: Validate VJ compression slot parameters completely
     (CVE-2015-7799)
+  * [x86] KVM: svm: unconditionally intercept #DB (CVE-2015-8104)
 
  -- Ben Hutchings <ben at decadent.org.uk>  Wed, 14 Oct 2015 01:11:17 +0100
 
diff --git a/debian/patches/bugfix/x86/kvm-svm-unconditionally-intercept-db.patch b/debian/patches/bugfix/x86/kvm-svm-unconditionally-intercept-db.patch
new file mode 100644
index 0000000..ba38dc7
--- /dev/null
+++ b/debian/patches/bugfix/x86/kvm-svm-unconditionally-intercept-db.patch
@@ -0,0 +1,83 @@
+From: Paolo Bonzini <pbonzini at redhat.com>
+Date: Tue, 10 Nov 2015 09:14:39 +0100
+Subject: KVM: svm: unconditionally intercept #DB
+Origin: https://git.kernel.org/linus/cbdb967af3d54993f5814f1cee0ed311a055377d
+
+This is needed to avoid the possibility that the guest triggers
+an infinite stream of #DB exceptions (CVE-2015-8104).
+
+VMX is not affected: because it does not save DR6 in the VMCS,
+it already intercepts #DB unconditionally.
+
+Reported-by: Jan Beulich <jbeulich at suse.com>
+Cc: stable at vger.kernel.org
+Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>
+[bwh: Backported to 3.2: #DB and #BP did not share a function, and there is
+ no operation pointer referring to it, so remove update_db_intercept()
+ entirely]
+---
+ arch/x86/kvm/svm.c | 14 +++-----------
+ 1 file changed, 3 insertions(+), 11 deletions(-)
+
+--- a/arch/x86/kvm/svm.c
++++ b/arch/x86/kvm/svm.c
+@@ -1015,6 +1015,7 @@ static void init_vmcb(struct vcpu_svm *s
+ 	set_exception_intercept(svm, UD_VECTOR);
+ 	set_exception_intercept(svm, MC_VECTOR);
+ 	set_exception_intercept(svm, AC_VECTOR);
++	set_exception_intercept(svm, DB_VECTOR);
+ 
+ 	set_intercept(svm, INTERCEPT_INTR);
+ 	set_intercept(svm, INTERCEPT_NMI);
+@@ -1550,26 +1551,6 @@ static void svm_set_segment(struct kvm_v
+ 	mark_dirty(svm->vmcb, VMCB_SEG);
+ }
+ 
+-static void update_db_intercept(struct kvm_vcpu *vcpu)
+-{
+-	struct vcpu_svm *svm = to_svm(vcpu);
+-
+-	clr_exception_intercept(svm, DB_VECTOR);
+-	clr_exception_intercept(svm, BP_VECTOR);
+-
+-	if (svm->nmi_singlestep)
+-		set_exception_intercept(svm, DB_VECTOR);
+-
+-	if (vcpu->guest_debug & KVM_GUESTDBG_ENABLE) {
+-		if (vcpu->guest_debug &
+-		    (KVM_GUESTDBG_SINGLESTEP | KVM_GUESTDBG_USE_HW_BP))
+-			set_exception_intercept(svm, DB_VECTOR);
+-		if (vcpu->guest_debug & KVM_GUESTDBG_USE_SW_BP)
+-			set_exception_intercept(svm, BP_VECTOR);
+-	} else
+-		vcpu->guest_debug = 0;
+-}
+-
+ static void svm_guest_debug(struct kvm_vcpu *vcpu, struct kvm_guest_debug *dbg)
+ {
+ 	struct vcpu_svm *svm = to_svm(vcpu);
+@@ -1580,8 +1561,6 @@ static void svm_guest_debug(struct kvm_v
+ 		svm->vmcb->save.dr7 = vcpu->arch.dr7;
+ 
+ 	mark_dirty(svm->vmcb, VMCB_DR);
+-
+-	update_db_intercept(vcpu);
+ }
+ 
+ static void new_asid(struct vcpu_svm *svm, struct svm_cpu_data *sd)
+@@ -1655,7 +1634,6 @@ static int db_interception(struct vcpu_s
+ 		if (!(svm->vcpu.guest_debug & KVM_GUESTDBG_SINGLESTEP))
+ 			svm->vmcb->save.rflags &=
+ 				~(X86_EFLAGS_TF | X86_EFLAGS_RF);
+-		update_db_intercept(&svm->vcpu);
+ 	}
+ 
+ 	if (svm->vcpu.guest_debug &
+@@ -3557,7 +3535,6 @@ static void enable_nmi_window(struct kvm
+ 	 */
+ 	svm->nmi_singlestep = true;
+ 	svm->vmcb->save.rflags |= (X86_EFLAGS_TF | X86_EFLAGS_RF);
+-	update_db_intercept(vcpu);
+ }
+ 
+ static int svm_set_tss_addr(struct kvm *kvm, unsigned int addr)
diff --git a/debian/patches/series b/debian/patches/series
index 5fbfc3f..dcd2af9 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -1164,3 +1164,4 @@ bugfix/all/usbvision-fix-overflow-of-interfaces-array.patch
 bugfix/all/rds-fix-race-condition-when-sending-a-message-on-unbound-socket.patch
 bugfix/all/isdn_ppp-add-checks-for-allocation-failure-in-isdn_p.patch
 bugfix/all/ppp-slip-validate-vj-compression-slot-parameters-com.patch
+bugfix/x86/kvm-svm-unconditionally-intercept-db.patch

-- 
Alioth's /usr/local/bin/git-commit-notice on /srv/git.debian.org/git/kernel/linux.git