Patch-mainline: v5.6-rc1

Git-commit: 6ec4c5eee1750d5d17951c4e1960d953376a0dda

From: Marios Pomonis <pomonis@google.com>

Date: Wed, 11 Dec 2019 12:47:49 -0800

Subject: [PATCH] KVM: x86: Protect MSR-based index computations from

 Spectre-v1/L1TF attacks in x86.c

References: bsc#1164733

This fixes a Spectre-v1/L1TF vulnerability in set_msr_mce() and

get_msr_mce().

Both functions contain index computations based on the

(attacker-controlled) MSR number.

Fixes: 890ca9aefa78 ("KVM: Add MCE support")

Signed-off-by: Nick Finco <nifi@google.com>

Signed-off-by: Marios Pomonis <pomonis@google.com>

Reviewed-by: Andrew Honig <ahonig@google.com>

Cc: stable@vger.kernel.org

Reviewed-by: Jim Mattson <jmattson@google.com>

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

Signed-off-by: Juergen Gross <jgross@suse.com>

---

 arch/x86/kvm/x86.c | 10 ++++++++--

 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c

index 985066e1bda5..913e55f6dca3 100644

--- a/arch/x86/kvm/x86.c

+++ b/arch/x86/kvm/x86.c

@@ -2138,7 +2138,10 @@ static int set_msr_mce(struct kvm_vcpu *vcpu, struct msr_data *msr_info)

 	default:

 		if (msr >= MSR_IA32_MC0_CTL &&

 		    msr < MSR_IA32_MCx_CTL(bank_num)) {

-			u32 offset = msr - MSR_IA32_MC0_CTL;

+			u32 offset = array_index_nospec(

+				msr - MSR_IA32_MC0_CTL,

+				MSR_IA32_MCx_CTL(bank_num) - MSR_IA32_MC0_CTL);

+

 			/* only 0 or all 1s can be written to IA32_MCi_CTL

 			 * some Linux kernels though clear bit 10 in bank 4 to

 			 * workaround a BIOS/GART TBL issue on AMD K8s, ignore

@@ -2526,7 +2529,10 @@ static int get_msr_mce(struct kvm_vcpu *vcpu, u32 msr, u64 *pdata, bool host)

 	default:

 		if (msr >= MSR_IA32_MC0_CTL &&

 		    msr < MSR_IA32_MCx_CTL(bank_num)) {

-			u32 offset = msr - MSR_IA32_MC0_CTL;

+			u32 offset = array_index_nospec(

+				msr - MSR_IA32_MC0_CTL,

+				MSR_IA32_MCx_CTL(bank_num) - MSR_IA32_MC0_CTL);

+

 			data = vcpu->arch.mce_banks[offset];

 			break;

 		}

-- 

2.16.4