| From 6ec4c5eee1750d5d17951c4e1960d953376a0dda Mon Sep 17 00:00:00 2001 |
| From: Marios Pomonis <pomonis@google.com> |
| Date: Wed, 11 Dec 2019 12:47:49 -0800 |
| Subject: KVM: x86: Protect MSR-based index computations from Spectre-v1/L1TF attacks in x86.c |
| |
| From: Marios Pomonis <pomonis@google.com> |
| |
| commit 6ec4c5eee1750d5d17951c4e1960d953376a0dda upstream. |
| |
| This fixes a Spectre-v1/L1TF vulnerability in set_msr_mce() and |
| get_msr_mce(). |
| Both functions contain index computations based on the |
| (attacker-controlled) MSR number. |
| |
| Fixes: 890ca9aefa78 ("KVM: Add MCE support") |
| |
| Signed-off-by: Nick Finco <nifi@google.com> |
| Signed-off-by: Marios Pomonis <pomonis@google.com> |
| Reviewed-by: Andrew Honig <ahonig@google.com> |
| Cc: stable@vger.kernel.org |
| Reviewed-by: Jim Mattson <jmattson@google.com> |
| Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| |
| --- |
| arch/x86/kvm/x86.c | 10 ++++++++-- |
| 1 file changed, 8 insertions(+), 2 deletions(-) |
| |
| --- a/arch/x86/kvm/x86.c |
| +++ b/arch/x86/kvm/x86.c |
| @@ -2273,7 +2273,10 @@ static int set_msr_mce(struct kvm_vcpu * |
| default: |
| if (msr >= MSR_IA32_MC0_CTL && |
| msr < MSR_IA32_MCx_CTL(bank_num)) { |
| - u32 offset = msr - MSR_IA32_MC0_CTL; |
| + u32 offset = array_index_nospec( |
| + msr - MSR_IA32_MC0_CTL, |
| + MSR_IA32_MCx_CTL(bank_num) - MSR_IA32_MC0_CTL); |
| + |
| /* only 0 or all 1s can be written to IA32_MCi_CTL |
| * some Linux kernels though clear bit 10 in bank 4 to |
| * workaround a BIOS/GART TBL issue on AMD K8s, ignore |
| @@ -2685,7 +2688,10 @@ static int get_msr_mce(struct kvm_vcpu * |
| default: |
| if (msr >= MSR_IA32_MC0_CTL && |
| msr < MSR_IA32_MCx_CTL(bank_num)) { |
| - u32 offset = msr - MSR_IA32_MC0_CTL; |
| + u32 offset = array_index_nospec( |
| + msr - MSR_IA32_MC0_CTL, |
| + MSR_IA32_MCx_CTL(bank_num) - MSR_IA32_MC0_CTL); |
| + |
| data = vcpu->arch.mce_banks[offset]; |
| break; |
| } |