Commit c926f2f7 authored by Marios Pomonis's avatar Marios Pomonis Committed by Paolo Bonzini
Browse files

KVM: x86: Protect exit_reason from being used in Spectre-v1/L1TF attacks 



This fixes a Spectre-v1/L1TF vulnerability in vmx_handle_exit().
While exit_reason is set by the hardware and therefore should not be
attacker-influenced, an unknown exit_reason could potentially be used to
perform such an attack.

Fixes: 55d2375e ("KVM: nVMX: Move nested code to dedicated files")

Signed-off-by: default avatarMarios Pomonis <pomonis@google.com>
Signed-off-by: default avatarNick Finco <nifi@google.com>
Suggested-by: default avatarSean Christopherson <sean.j.christopherson@intel.com>
Reviewed-by: default avatarAndrew Honig <ahonig@google.com>
Cc: stable@vger.kernel.org
Signed-off-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
parent 125ffc5e

arch/x86/kvm/vmx/vmx.c

+32 −25
Original line number Diff line number Diff line
@@ -5913,8 +5913,10 @@ static int vmx_handle_exit(struct kvm_vcpu *vcpu, 
	if (exit_fastpath == EXIT_FASTPATH_SKIP_EMUL_INS) {

		kvm_skip_emulated_instruction(vcpu);

		return 1;

	} else if (exit_reason < kvm_vmx_max_exit_handlers

	    && kvm_vmx_exit_handlers[exit_reason]) {

	}



	if (exit_reason >= kvm_vmx_max_exit_handlers)

		goto unexpected_vmexit;

#ifdef CONFIG_RETPOLINE

	if (exit_reason == EXIT_REASON_MSR_WRITE)

		return kvm_emulate_wrmsr(vcpu);
@@ -5929,10 +5931,16 @@ static int vmx_handle_exit(struct kvm_vcpu *vcpu, 
	else if (exit_reason == EXIT_REASON_EPT_MISCONFIG)

		return handle_ept_misconfig(vcpu);

#endif



	exit_reason = array_index_nospec(exit_reason,

					 kvm_vmx_max_exit_handlers);

	if (!kvm_vmx_exit_handlers[exit_reason])

		goto unexpected_vmexit;



	return kvm_vmx_exit_handlers[exit_reason](vcpu);

	} else {

		vcpu_unimpl(vcpu, "vmx: unexpected exit reason 0x%x\n",

				exit_reason);



unexpected_vmexit:

	vcpu_unimpl(vcpu, "vmx: unexpected exit reason 0x%x\n", exit_reason);

	dump_vmcs();

	vcpu->run->exit_reason = KVM_EXIT_INTERNAL_ERROR;

	vcpu->run->internal.suberror =
@@ -5941,7 +5949,6 @@ static int vmx_handle_exit(struct kvm_vcpu *vcpu, 
	vcpu->run->internal.data[0] = exit_reason;

	return 0;

}

}



/*

 * Software based L1D cache flush which is used when microcode providing

CRA Git | Maintained and supported by SUSTech CRA and CCSE