• Paolo Bonzini's avatar
    KVM: x86: fix singlestepping over syscall · c8401dda
    Paolo Bonzini authored
    TF is handled a bit differently for syscall and sysret, compared
    to the other instructions: TF is checked after the instruction completes,
    so that the OS can disable #DB at a syscall by adding TF to FMASK.
    When the sysret is executed the #DB is taken "as if" the syscall insn
    just completed.
    
    KVM emulates syscall so that it can trap 32-bit syscall on Intel processors.
    Fix the behavior, otherwise you could get #DB on a user stack which is not
    nice.  This does not affect Linux guests, as they use an IST or task gate
    for #DB.
    
    This fixes CVE-2017-7518.
    
    Cc: stable@vger.kernel.org
    Reported-by: default avatarAndy Lutomirski <luto@kernel.org>
    Signed-off-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
    Signed-off-by: default avatarRadim Krčmář <rkrcmar@redhat.com>
    c8401dda
x86.c 223 KB