Commit 4bf79cb0 authored by Marios Pomonis's avatar Marios Pomonis Committed by Paolo Bonzini
Browse files

KVM: x86: Protect kvm_lapic_reg_write() from Spectre-v1/L1TF attacks 



This fixes a Spectre-v1/L1TF vulnerability in kvm_lapic_reg_write().
This function contains index computations based on the
(attacker-controlled) MSR number.

Fixes: 0105d1a5 ("KVM: x2apic interface to lapic")

Signed-off-by: default avatarNick Finco <nifi@google.com>
Signed-off-by: default avatarMarios Pomonis <pomonis@google.com>
Reviewed-by: default avatarAndrew Honig <ahonig@google.com>
Cc: stable@vger.kernel.org
Reviewed-by: default avatarJim Mattson <jmattson@google.com>
Signed-off-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
parent 67056455

arch/x86/kvm/lapic.c

+9 −4
Original line number Diff line number Diff line
@@ -1960,15 +1960,20 @@ int kvm_lapic_reg_write(struct kvm_lapic *apic, u32 reg, u32 val) 
	case APIC_LVTTHMR:

	case APIC_LVTPC:

	case APIC_LVT1:

	case APIC_LVTERR:

	case APIC_LVTERR: {

		/* TODO: Check vector */

		size_t size;

		u32 index;



		if (!kvm_apic_sw_enabled(apic))

			val |= APIC_LVT_MASKED;



		val &= apic_lvt_mask[(reg - APIC_LVTT) >> 4];

		size = ARRAY_SIZE(apic_lvt_mask);

		index = array_index_nospec(

				(reg - APIC_LVTT) >> 4, size);

		val &= apic_lvt_mask[index];

		kvm_lapic_set_reg(apic, reg, val);



		break;

	}



	case APIC_LVTT:

		if (!kvm_apic_sw_enabled(apic))