Commit 6ec4c5ee authored by Marios Pomonis's avatar Marios Pomonis Committed by Paolo Bonzini
Browse files

KVM: x86: Protect MSR-based index computations from Spectre-v1/L1TF attacks in x86.c 



This fixes a Spectre-v1/L1TF vulnerability in set_msr_mce() and
get_msr_mce().
Both functions contain index computations based on the
(attacker-controlled) MSR number.

Fixes: 890ca9ae ("KVM: Add MCE support")

Signed-off-by: default avatarNick Finco <nifi@google.com>
Signed-off-by: default avatarMarios Pomonis <pomonis@google.com>
Reviewed-by: default avatarAndrew Honig <ahonig@google.com>
Cc: stable@vger.kernel.org
Reviewed-by: default avatarJim Mattson <jmattson@google.com>
Signed-off-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
parent 13c5183a

arch/x86/kvm/x86.c

+8 −2
Original line number Diff line number Diff line
@@ -2545,7 +2545,10 @@ static int set_msr_mce(struct kvm_vcpu *vcpu, struct msr_data *msr_info) 
	default:

		if (msr >= MSR_IA32_MC0_CTL &&

		    msr < MSR_IA32_MCx_CTL(bank_num)) {

			u32 offset = msr - MSR_IA32_MC0_CTL;

			u32 offset = array_index_nospec(

				msr - MSR_IA32_MC0_CTL,

				MSR_IA32_MCx_CTL(bank_num) - MSR_IA32_MC0_CTL);



			/* only 0 or all 1s can be written to IA32_MCi_CTL

			 * some Linux kernels though clear bit 10 in bank 4 to

			 * workaround a BIOS/GART TBL issue on AMD K8s, ignore
@@ -2986,7 +2989,10 @@ static int get_msr_mce(struct kvm_vcpu *vcpu, u32 msr, u64 *pdata, bool host) 
	default:

		if (msr >= MSR_IA32_MC0_CTL &&

		    msr < MSR_IA32_MCx_CTL(bank_num)) {

			u32 offset = msr - MSR_IA32_MC0_CTL;

			u32 offset = array_index_nospec(

				msr - MSR_IA32_MC0_CTL,

				MSR_IA32_MCx_CTL(bank_num) - MSR_IA32_MC0_CTL);



			data = vcpu->arch.mce_banks[offset];

			break;

		}