Received: by 10.223.185.116 with SMTP id b49csp1117780wrg; Fri, 23 Feb 2018 12:13:58 -0800 (PST) X-Google-Smtp-Source: AH8x224nqo/8yYN6jmueRGIgX8dKsvGfI+zwGMSAl231Z0S0MbaOpxHRXTt+O4cHuTE3M6oCMN4k X-Received: by 2002:a17:902:8341:: with SMTP id z1-v6mr2818016pln.386.1519416838862; Fri, 23 Feb 2018 12:13:58 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1519416838; cv=none; d=google.com; s=arc-20160816; b=vKVjGCJyBDX49B8epiwDcTrrzywBBKspA9wnj9H5O3gt+5CFCgJrAOarS8ETenUCDU b6KAt+eBJULWQ7qSeuH7WmgVKRKz9stRLHpDM6E445ZC6FnJg1M/FoePszy94gEkPH58 k64kSD0IWO/ue+NxkD56fj0dSH0P+aHB13o3O94KNX4m2eRlNbOMyBScw2l4mFSGlnxb z9Kag5KVnoT8cq4ihzGwm6oJXsFLOlwepqDA45DeltgonG69kiitckq8I5rEzFo09/1V 4ETMNm5pBOHi9Y4wha5bRQSR+TwVjygDyWTU0MDF/ZDkXp4vPvBDF1BVsyUZ6wQ31JpN E8RA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:mime-version:user-agent:references :in-reply-to:message-id:date:subject:cc:to:from :arc-authentication-results; bh=e0CorWlEMDv6yqr8x/aS7JKis/FhyCmFspzUEHbrjR4=; b=yMGSuV5fm8Bwa5JW5co8YpwU5qSSyTV92Hxt6WjsDLnlp+SWwEzPZObA7QyFI5UyCR LdR2vO7XGeB+Vz81shsIA0a/cYr9zVYRAgoQu9oddcUZnCzn7N29cUcr0Kb9VVSrHZw7 yinyjrhqamf5Jlr4f4SYZLWkR10KHMRmjLFgGgisayT9at/9RLFWwtov3Pn8Z+AqTN2o pEVf60bsz13L7Nw9Ntk4f0k6swQPtgblwX78EMkerKM8/KeS5U4C9flTOA26UCzBxym7 X1bE2JjXhWYyYKsCQZ1z0AbkA971LXZexydzlMFotdF9zEU/t2s8aGWzuUQfZCoY4DSa jnjw== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id b84si2293022pfj.183.2018.02.23.12.13.43; Fri, 23 Feb 2018 12:13:58 -0800 (PST) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S932872AbeBWSlb (ORCPT + 99 others); Fri, 23 Feb 2018 13:41:31 -0500 Received: from mail.linuxfoundation.org ([140.211.169.12]:40598 "EHLO mail.linuxfoundation.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S932458AbeBWSl2 (ORCPT ); Fri, 23 Feb 2018 13:41:28 -0500 Received: from localhost (LFbn-1-12258-90.w90-92.abo.wanadoo.fr [90.92.71.90]) by mail.linuxfoundation.org (Postfix) with ESMTPSA id AA72F128B; Fri, 23 Feb 2018 18:41:27 +0000 (UTC) From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Dan Williams , Thomas Gleixner , Paolo Bonzini , Andrew Honig , kvm@vger.kernel.org, Jim Mattson , David Woodhouse , Jack Wang Subject: [PATCH 4.4 184/193] x86/kvm: Update spectre-v1 mitigation Date: Fri, 23 Feb 2018 19:26:57 +0100 Message-Id: <20180223170355.027164348@linuxfoundation.org> X-Mailer: git-send-email 2.16.2 In-Reply-To: <20180223170325.997716448@linuxfoundation.org> References: <20180223170325.997716448@linuxfoundation.org> User-Agent: quilt/0.65 X-stable: review MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org 4.4-stable review patch. If anyone has any objections, please let me know. ------------------ From: Dan Williams (cherry picked from commit 085331dfc6bbe3501fb936e657331ca943827600) Commit 75f139aaf896 "KVM: x86: Add memory barrier on vmcs field lookup" added a raw 'asm("lfence");' to prevent a bounds check bypass of 'vmcs_field_to_offset_table'. The lfence can be avoided in this path by using the array_index_nospec() helper designed for these types of fixes. Signed-off-by: Dan Williams Signed-off-by: Thomas Gleixner Acked-by: Paolo Bonzini Cc: Andrew Honig Cc: kvm@vger.kernel.org Cc: Jim Mattson Link: https://lkml.kernel.org/r/151744959670.6342.3001723920950249067.stgit@dwillia2-desk3.amr.corp.intel.com Signed-off-by: David Woodhouse [jwang: cherry pick to 4.4] Signed-off-by: Jack Wang Signed-off-by: Greg Kroah-Hartman --- arch/x86/kvm/vmx.c | 20 +++++++++----------- 1 file changed, 9 insertions(+), 11 deletions(-) --- a/arch/x86/kvm/vmx.c +++ b/arch/x86/kvm/vmx.c @@ -32,6 +32,7 @@ #include #include #include +#include #include "kvm_cache_regs.h" #include "x86.h" @@ -827,21 +828,18 @@ static const unsigned short vmcs_field_t static inline short vmcs_field_to_offset(unsigned long field) { - BUILD_BUG_ON(ARRAY_SIZE(vmcs_field_to_offset_table) > SHRT_MAX); + const size_t size = ARRAY_SIZE(vmcs_field_to_offset_table); + unsigned short offset; - if (field >= ARRAY_SIZE(vmcs_field_to_offset_table)) + BUILD_BUG_ON(size > SHRT_MAX); + if (field >= size) return -ENOENT; - /* - * FIXME: Mitigation for CVE-2017-5753. To be replaced with a - * generic mechanism. - */ - asm("lfence"); - - if (vmcs_field_to_offset_table[field] == 0) + field = array_index_nospec(field, size); + offset = vmcs_field_to_offset_table[field]; + if (offset == 0) return -ENOENT; - - return vmcs_field_to_offset_table[field]; + return offset; } static inline struct vmcs12 *get_vmcs12(struct kvm_vcpu *vcpu)