KVM: x86: Protect kvm_hv_msr_[get|set]_crash_data() from Spectre-v1/L1TF attacks (86187937) · Commits · 戴 / test

This fixes Spectre-v1/L1TF vulnerabilities in kvm_hv_msr_get_crash_data() and kvm_hv_msr_set_crash_data(). These functions contain index computations that use the (attacker-controlled) MSR number. Fixes: ("kvm/x86: added hyper-v crash msrs into kvm hyperv context") Signed-off-by:

Nick Finco <nifi@google.com> Signed-off-by:

Marios Pomonis <pomonis@google.com> Reviewed-by:

Andrew Honig <ahonig@google.com> Cc: stable@vger.kernel.org Signed-off-by:

Paolo Bonzini <pbonzini@redhat.com>

arch/x86/kvm/hyperv.c

+6 −4

Original line number	Diff line number	Diff line
		@@ -810,11 +810,12 @@ static int kvm_hv_msr_get_crash_data(struct kvm_vcpu *vcpu,
		u32 index, u64 *pdata)
		{
		struct kvm_hv *hv = &vcpu->kvm->arch.hyperv;
		size_t size = ARRAY_SIZE(hv->hv_crash_param);

		if (WARN_ON_ONCE(index >= ARRAY_SIZE(hv->hv_crash_param)))
		if (WARN_ON_ONCE(index >= size))
		return -EINVAL;

		*pdata = hv->hv_crash_param[index];
		*pdata = hv->hv_crash_param[array_index_nospec(index, size)];
		return 0;
		}

		@@ -853,11 +854,12 @@ static int kvm_hv_msr_set_crash_data(struct kvm_vcpu *vcpu,
		u32 index, u64 data)
		{
		struct kvm_hv *hv = &vcpu->kvm->arch.hyperv;
		size_t size = ARRAY_SIZE(hv->hv_crash_param);

		if (WARN_ON_ONCE(index >= ARRAY_SIZE(hv->hv_crash_param)))
		if (WARN_ON_ONCE(index >= size))
		return -EINVAL;

		hv->hv_crash_param[index] = data;
		hv->hv_crash_param[array_index_nospec(index, size)] = data;
		return 0;
		}

Admin message