KVM: x86: Protect MSR-based index computations from Spectre-v1/L1TF attacks in x86.c (6ec4c5ee) · Commits · 戴 / test

This fixes a Spectre-v1/L1TF vulnerability in set_msr_mce() and get_msr_mce(). Both functions contain index computations based on the (attacker-controlled) MSR number. Fixes: ("KVM: Add MCE support") Signed-off-by:

Nick Finco <nifi@google.com> Signed-off-by:

Marios Pomonis <pomonis@google.com> Reviewed-by:

Andrew Honig <ahonig@google.com> Cc: stable@vger.kernel.org Reviewed-by:

Jim Mattson <jmattson@google.com> Signed-off-by:

Paolo Bonzini <pbonzini@redhat.com>

arch/x86/kvm/x86.c

+8 −2

Original line number	Diff line number	Diff line
		@@ -2545,7 +2545,10 @@ static int set_msr_mce(struct kvm_vcpu vcpu, struct msr_data msr_info)
		default:
		if (msr >= MSR_IA32_MC0_CTL &&
		msr < MSR_IA32_MCx_CTL(bank_num)) {
		u32 offset = msr - MSR_IA32_MC0_CTL;
		u32 offset = array_index_nospec(
		msr - MSR_IA32_MC0_CTL,
		MSR_IA32_MCx_CTL(bank_num) - MSR_IA32_MC0_CTL);

		/* only 0 or all 1s can be written to IA32_MCi_CTL
		* some Linux kernels though clear bit 10 in bank 4 to
		* workaround a BIOS/GART TBL issue on AMD K8s, ignore
		@@ -2986,7 +2989,10 @@ static int get_msr_mce(struct kvm_vcpu vcpu, u32 msr, u64 pdata, bool host)
		default:
		if (msr >= MSR_IA32_MC0_CTL &&
		msr < MSR_IA32_MCx_CTL(bank_num)) {
		u32 offset = msr - MSR_IA32_MC0_CTL;
		u32 offset = array_index_nospec(
		msr - MSR_IA32_MC0_CTL,
		MSR_IA32_MCx_CTL(bank_num) - MSR_IA32_MC0_CTL);

		data = vcpu->arch.mce_banks[offset];
		break;
		}

Admin message