lkml.org 
[lkml]   [2020]   [Feb]   [10]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.4 207/309] KVM: x86: Protect MSR-based index computations from Spectre-v1/L1TF attacks in x86.c
    Date
    From: Marios Pomonis <pomonis@google.com>

    commit 6ec4c5eee1750d5d17951c4e1960d953376a0dda upstream.

    This fixes a Spectre-v1/L1TF vulnerability in set_msr_mce() and
    get_msr_mce().
    Both functions contain index computations based on the
    (attacker-controlled) MSR number.

    Fixes: 890ca9aefa78 ("KVM: Add MCE support")

    Signed-off-by: Nick Finco <nifi@google.com>
    Signed-off-by: Marios Pomonis <pomonis@google.com>
    Reviewed-by: Andrew Honig <ahonig@google.com>
    Cc: stable@vger.kernel.org
    Reviewed-by: Jim Mattson <jmattson@google.com>
    Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    arch/x86/kvm/x86.c | 10 ++++++++--
    1 file changed, 8 insertions(+), 2 deletions(-)

    --- a/arch/x86/kvm/x86.c
    +++ b/arch/x86/kvm/x86.c
    @@ -2494,7 +2494,10 @@ static int set_msr_mce(struct kvm_vcpu *
    default:
    if (msr >= MSR_IA32_MC0_CTL &&
    msr < MSR_IA32_MCx_CTL(bank_num)) {
    - u32 offset = msr - MSR_IA32_MC0_CTL;
    + u32 offset = array_index_nospec(
    + msr - MSR_IA32_MC0_CTL,
    + MSR_IA32_MCx_CTL(bank_num) - MSR_IA32_MC0_CTL);
    +
    /* only 0 or all 1s can be written to IA32_MCi_CTL
    * some Linux kernels though clear bit 10 in bank 4 to
    * workaround a BIOS/GART TBL issue on AMD K8s, ignore
    @@ -2921,7 +2924,10 @@ static int get_msr_mce(struct kvm_vcpu *
    default:
    if (msr >= MSR_IA32_MC0_CTL &&
    msr < MSR_IA32_MCx_CTL(bank_num)) {
    - u32 offset = msr - MSR_IA32_MC0_CTL;
    + u32 offset = array_index_nospec(
    + msr - MSR_IA32_MC0_CTL,
    + MSR_IA32_MCx_CTL(bank_num) - MSR_IA32_MC0_CTL);
    +
    data = vcpu->arch.mce_banks[offset];
    break;
    }

    \
     
     \ /
      Last update: 2020-02-10 14:04    [W:4.069 / U:0.964 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site