From 2e8fe68c27cd6087603a27b967a78f77c3a7d637 Mon Sep 17 00:00:00 2001
From: Stephen Brennan <stephen.s.brennan@oracle.com>
Date: Thu, 14 Apr 2022 13:27:45 -0700
Subject: [PATCH] debug: Lock down kgdb

Patch-mainline: Not yet, EMBARGOED 
References: bsc#1199426

KGDB and KDB allow read and write access to kernel memory, and thus
should not be allowed during lockdown. An attacker with access to a
serial port (for example, via a hypervisor console, which some cloud
vendors provide over the network) could trigger the debugger and use it
to bypass lockdown. Ensure KDB and KGDB cannot be used during lockdown.

This fixes CVE-2022-21499.

Signed-off-by: Stephen Brennan <stephen.s.brennan@oracle.com>
Signed-off-by: Lee, Chun-Yi <jlee@suse.com>
---
 kernel/debug/debug_core.c |    2 ++
 1 file changed, 2 insertions(+)

--- a/kernel/debug/debug_core.c
+++ b/kernel/debug/debug_core.c
@@ -621,6 +621,8 @@ return_normal:
 
 	while (1) {
 cpu_master_loop:
+		if (kernel_is_locked_down())
+			break;
 		if (dbg_kdb_mode) {
 			kgdb_connected = 1;
 			error = kdb_stub(ks);