Patch-mainline: v5.6-rc1

Git-commit: 670564559ca35b439c8d8861fc399451ddf95137

From: Marios Pomonis <pomonis@google.com>

Date: Wed, 11 Dec 2019 12:47:45 -0800

Subject: [PATCH] KVM: x86: Protect ioapic_write_indirect() from

 Spectre-v1/L1TF attacks

References: bsc#1164729

This fixes a Spectre-v1/L1TF vulnerability in ioapic_write_indirect().

This function contains index computations based on the

(attacker-controlled) IOREGSEL register.

This patch depends on patch

"KVM: x86: Protect ioapic_read_indirect() from Spectre-v1/L1TF attacks".

Fixes: 70f93dae32ac ("KVM: Use temporary variable to shorten lines.")

Signed-off-by: Nick Finco <nifi@google.com>

Signed-off-by: Marios Pomonis <pomonis@google.com>

Reviewed-by: Andrew Honig <ahonig@google.com>

Cc: stable@vger.kernel.org

Reviewed-by: Jim Mattson <jmattson@google.com>

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

Signed-off-by: Juergen Gross <jgross@suse.com>

---

 arch/x86/kvm/ioapic.c | 1 +

 1 file changed, 1 insertion(+)

diff --git a/arch/x86/kvm/ioapic.c b/arch/x86/kvm/ioapic.c

index c5776febb517..26aa22cb9b29 100644

--- a/arch/x86/kvm/ioapic.c

+++ b/arch/x86/kvm/ioapic.c

@@ -299,6 +299,7 @@ static void ioapic_write_indirect(struct kvm_ioapic *ioapic, u32 val)

 		ioapic_debug("change redir index %x val %x\n", index, val);

 		if (index >= IOAPIC_NUM_PINS)

 			return;

+		index = array_index_nospec(index, IOAPIC_NUM_PINS);

 		e = &ioapic->redirtbl[index];

 		mask_before = e->fields.mask;

 		/* Preserve read-only fields */

-- 

2.16.4