summaryrefslogtreecommitdiff
path: root/arch
diff options
context:
space:
mode:
authorLai Jiangshan <laijs@linux.alibaba.com>2021-02-04 18:27:07 +0300
committerThomas Gleixner <tglx@linutronix.de>2021-02-05 22:13:12 +0300
commit3943abf2dbfae9ea4d2da05c1db569a0603f76da (patch)
tree36182b39ffc8b5ad40e4985c999665c8b5e26956 /arch
parentc4bed4b96918ff1d062ee81fdae4d207da4fa9b0 (diff)
downloadlinux-3943abf2dbfae9ea4d2da05c1db569a0603f76da.tar.xz
x86/debug: Prevent data breakpoints on cpu_dr7
local_db_save() is called at the start of exc_debug_kernel(), reads DR7 and disables breakpoints to prevent recursion. When running in a guest (X86_FEATURE_HYPERVISOR), local_db_save() reads the per-cpu variable cpu_dr7 to check whether a breakpoint is active or not before it accesses DR7. A data breakpoint on cpu_dr7 therefore results in infinite #DB recursion. Disallow data breakpoints on cpu_dr7 to prevent that. Fixes: 84b6a3491567a("x86/entry: Optimize local_db_save() for virt") Signed-off-by: Lai Jiangshan <laijs@linux.alibaba.com> Signed-off-by: Thomas Gleixner <tglx@linutronix.de> Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20210204152708.21308-2-jiangshanlai@gmail.com
Diffstat (limited to 'arch')
-rw-r--r--arch/x86/kernel/hw_breakpoint.c8
1 files changed, 8 insertions, 0 deletions
diff --git a/arch/x86/kernel/hw_breakpoint.c b/arch/x86/kernel/hw_breakpoint.c
index 012ed82e5bd3..668a4a6533d9 100644
--- a/arch/x86/kernel/hw_breakpoint.c
+++ b/arch/x86/kernel/hw_breakpoint.c
@@ -307,6 +307,14 @@ static inline bool within_cpu_entry(unsigned long addr, unsigned long end)
(unsigned long)&per_cpu(cpu_tlbstate, cpu),
sizeof(struct tlb_state)))
return true;
+
+ /*
+ * When in guest (X86_FEATURE_HYPERVISOR), local_db_save()
+ * will read per-cpu cpu_dr7 before clear dr7 register.
+ */
+ if (within_area(addr, end, (unsigned long)&per_cpu(cpu_dr7, cpu),
+ sizeof(cpu_dr7)))
+ return true;
}
return false;