[PATCH] KVM: VMX: Add array_index_nospec() to evmcs_field_offset()

[PATCH] KVM: VMX: Add array_index_nospec() to evmcs_field_offset()

[Amirmohammad Eftekhar]

From: Amirmohammad Eftekhar <amirmohammad.eftekhar@cispa.de>

evmcs_field_offset() bounds-checks the guest-supplied field index against
nr_evmcs_1_fields and then indexes vmcs_field_to_evmcs_1[] with it, but,
unlike its vmcs12 counterpart get_vmcs12_field_offset(), it does not clamp
the index with array_index_nospec() after the check.  The field index is
derived from a guest-supplied VMCS field encoding on the enlightened
VMREAD/VMWRITE path, so the array access can be performed speculatively
past the bounds check (Spectre v1), disclosing memory adjacent to
vmcs_field_to_evmcs_1[].

Clamp the index with array_index_nospec() immediately after the bounds
check, mirroring get_vmcs12_field_offset().

Signed-off-by: Amirmohammad Eftekhar <amirmohammad.eftekhar@cispa.de>
---
 arch/x86/kvm/vmx/hyperv_evmcs.h | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/arch/x86/kvm/vmx/hyperv_evmcs.h b/arch/x86/kvm/vmx/hyperv_evmcs.h
index bc08fe40590e..052b62b8ed8e 100644
--- a/arch/x86/kvm/vmx/hyperv_evmcs.h
+++ b/arch/x86/kvm/vmx/hyperv_evmcs.h
@@ -136,6 +136,8 @@ static __always_inline int evmcs_field_offset(unsigned long field,
 	if (unlikely(index >= nr_evmcs_1_fields))
 		return -ENOENT;
 
+	index = array_index_nospec(index, nr_evmcs_1_fields);
+
 	evmcs_field = &vmcs_field_to_evmcs_1[index];
 
 	/*
-- 
2.43.0

[PATCH] KVM: VMX: Add array_index_nospec() to evmcs_field_offset()

[Amirmohammad Eftekhar]

evmcs_field_offset() bounds-checks the guest-supplied field index against
nr_evmcs_1_fields and then indexes vmcs_field_to_evmcs_1[] without an
array_index_nospec() clamp, unlike its vmcs12 counterpart
get_vmcs12_field_offset().  An enlightened VMREAD/VMWRITE from the guest
can therefore speculatively read out of bounds of vmcs_field_to_evmcs_1[]
past the bound check (Spectre v1).

Clamp the index with array_index_nospec(), mirroring
get_vmcs12_field_offset().

Signed-off-by: Amirmohammad Eftekhar <amirmohammad.eftekhar@cispa.de>
---
 arch/x86/kvm/vmx/hyperv_evmcs.h | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/arch/x86/kvm/vmx/hyperv_evmcs.h b/arch/x86/kvm/vmx/hyperv_evmcs.h
index bc08fe405..052b62b8e 100644
--- a/arch/x86/kvm/vmx/hyperv_evmcs.h
+++ b/arch/x86/kvm/vmx/hyperv_evmcs.h
@@ -136,6 +136,8 @@ static __always_inline int evmcs_field_offset(unsigned long field,
 	if (unlikely(index >= nr_evmcs_1_fields))
 		return -ENOENT;
 
+	index = array_index_nospec(index, nr_evmcs_1_fields);
+
 	evmcs_field = &vmcs_field_to_evmcs_1[index];
 
 	/*
-- 
2.54.0 (Apple Git-157)