[lkml]   [2021]   [Feb]   [8]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
    Patch in this message
    Subject[PATCH 5.10 109/120] x86/debug: Prevent data breakpoints on cpu_dr7
    From: Lai Jiangshan <>

    commit 3943abf2dbfae9ea4d2da05c1db569a0603f76da upstream.

    local_db_save() is called at the start of exc_debug_kernel(), reads DR7 and
    disables breakpoints to prevent recursion.

    When running in a guest (X86_FEATURE_HYPERVISOR), local_db_save() reads the
    per-cpu variable cpu_dr7 to check whether a breakpoint is active or not
    before it accesses DR7.

    A data breakpoint on cpu_dr7 therefore results in infinite #DB recursion.

    Disallow data breakpoints on cpu_dr7 to prevent that.

    Fixes: 84b6a3491567a("x86/entry: Optimize local_db_save() for virt")
    Signed-off-by: Lai Jiangshan <>
    Signed-off-by: Thomas Gleixner <>
    Signed-off-by: Greg Kroah-Hartman <>
    arch/x86/kernel/hw_breakpoint.c | 8 ++++++++
    1 file changed, 8 insertions(+)

    --- a/arch/x86/kernel/hw_breakpoint.c
    +++ b/arch/x86/kernel/hw_breakpoint.c
    @@ -307,6 +307,14 @@ static inline bool within_cpu_entry(unsi
    (unsigned long)&per_cpu(cpu_tlbstate, cpu),
    sizeof(struct tlb_state)))
    return true;
    + /*
    + * When in guest (X86_FEATURE_HYPERVISOR), local_db_save()
    + * will read per-cpu cpu_dr7 before clear dr7 register.
    + */
    + if (within_area(addr, end, (unsigned long)&per_cpu(cpu_dr7, cpu),
    + sizeof(cpu_dr7)))
    + return true;

    return false;

     \ /
      Last update: 2021-02-08 18:48    [W:3.063 / U:0.380 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site