| Message ID | 20191211204753.242298-13-pomonis@google.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | KVM: x86: Extend Spectre-v1 mitigation | expand |
On Wed, Dec 11, 2019 at 12:49 PM Marios Pomonis <pomonis@google.com> wrote: > > This fixes a Spectre-v1/L1TF vulnerability in __kvm_set_dr() and > kvm_get_dr(). > Both kvm_get_dr() and kvm_set_dr() (a wrapper of __kvm_set_dr()) are > exported symbols so KVM should tream them conservatively from a security > perspective. > > Fixes: commit 020df0794f57 ("KVM: move DR register access handling into generic code") > > Signed-off-by: Nick Finco <nifi@google.com> > Signed-off-by: Marios Pomonis <pomonis@google.com> > Reviewed-by: Andrew Honig <ahonig@google.com> > Cc: stable@vger.kernel.org Reviewed-by: Jim Mattson <jmattson@google.com>
diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c index a9e66f09422e..9a2789652231 100644 --- a/arch/x86/kvm/x86.c +++ b/arch/x86/kvm/x86.c @@ -1057,9 +1057,11 @@ static u64 kvm_dr6_fixed(struct kvm_vcpu *vcpu) static int __kvm_set_dr(struct kvm_vcpu *vcpu, int dr, unsigned long val) { + size_t size = ARRAY_SIZE(vcpu->arch.db); + switch (dr) { case 0 ... 3: - vcpu->arch.db[dr] = val; + vcpu->arch.db[array_index_nospec(dr, size)] = val; if (!(vcpu->guest_debug & KVM_GUESTDBG_USE_HW_BP)) vcpu->arch.eff_db[dr] = val; break; @@ -1096,9 +1098,11 @@ EXPORT_SYMBOL_GPL(kvm_set_dr); int kvm_get_dr(struct kvm_vcpu *vcpu, int dr, unsigned long *val) { + size_t size = ARRAY_SIZE(vcpu->arch.db); + switch (dr) { case 0 ... 3: - *val = vcpu->arch.db[dr]; + *val = vcpu->arch.db[array_index_nospec(dr, size)]; break; case 4: /* fall through */
This fixes a Spectre-v1/L1TF vulnerability in __kvm_set_dr() and kvm_get_dr(). Both kvm_get_dr() and kvm_set_dr() (a wrapper of __kvm_set_dr()) are exported symbols so KVM should tream them conservatively from a security perspective. Fixes: commit 020df0794f57 ("KVM: move DR register access handling into generic code") Signed-off-by: Nick Finco <nifi@google.com> Signed-off-by: Marios Pomonis <pomonis@google.com> Reviewed-by: Andrew Honig <ahonig@google.com> Cc: stable@vger.kernel.org --- arch/x86/kvm/x86.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)