Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
KVM: riscv: Fix Spectre-v1 in ONE_REG register access
User-controlled register indices from the ONE_REG ioctl are used to
index into arrays of register values. Sanitize them with
array_index_nospec() to prevent speculative out-of-bounds access.
Reviewed-by: Radim Krčmář <radim.krcmar@oss.qualcomm.com>
Signed-off-by: Lukas Gerlach <lukas.gerlach@cispa.de>
Link: https://lore.kernel.org/r/20260303-kvm-riscv-spectre-v1-v2-1-192caab8e0dc@cispa.de
Signed-off-by: Anup Patel <anup@brainfault.org>
authored by
Lukas Gerlach
and committed by
Anup Patel
f9e26fc3
b342166c
+28
-8
+28
-8
arch/riscv/kvm/vcpu_onereg.c
+28
-8
arch/riscv/kvm/vcpu_onereg.c
···
10
10
#include <linux/bitops.h>
11
11
#include <linux/errno.h>
12
12
#include <linux/err.h>
13
+
#include <linux/nospec.h>
13
14
#include <linux/uaccess.h>
14
15
#include <linux/kvm_host.h>
15
16
#include <asm/cacheflush.h>
···
128
127
kvm_ext >= ARRAY_SIZE(kvm_isa_ext_arr))
129
128
return -ENOENT;
130
129
130
+
kvm_ext = array_index_nospec(kvm_ext, ARRAY_SIZE(kvm_isa_ext_arr));
131
131
*guest_ext = kvm_isa_ext_arr[kvm_ext];
132
132
switch (*guest_ext) {
133
133
case RISCV_ISA_EXT_SMNPM:
···
445
443
unsigned long reg_num = reg->id & ~(KVM_REG_ARCH_MASK |
446
444
KVM_REG_SIZE_MASK |
447
445
KVM_REG_RISCV_CORE);
446
+
unsigned long regs_max = sizeof(struct kvm_riscv_core) / sizeof(unsigned long);
448
447
unsigned long reg_val;
449
448
450
449
if (KVM_REG_SIZE(reg->id) != sizeof(unsigned long))
451
450
return -EINVAL;
452
-
if (reg_num >= sizeof(struct kvm_riscv_core) / sizeof(unsigned long))
451
+
if (reg_num >= regs_max)
453
452
return -ENOENT;
453
+
454
+
reg_num = array_index_nospec(reg_num, regs_max);
454
455
455
456
if (reg_num == KVM_REG_RISCV_CORE_REG(regs.pc))
456
457
reg_val = cntx->sepc;
···
481
476
unsigned long reg_num = reg->id & ~(KVM_REG_ARCH_MASK |
482
477
KVM_REG_SIZE_MASK |
483
478
KVM_REG_RISCV_CORE);
479
+
unsigned long regs_max = sizeof(struct kvm_riscv_core) / sizeof(unsigned long);
484
480
unsigned long reg_val;
485
481
486
482
if (KVM_REG_SIZE(reg->id) != sizeof(unsigned long))
487
483
return -EINVAL;
488
-
if (reg_num >= sizeof(struct kvm_riscv_core) / sizeof(unsigned long))
484
+
if (reg_num >= regs_max)
489
485
return -ENOENT;
486
+
487
+
reg_num = array_index_nospec(reg_num, regs_max);
490
488
491
489
if (copy_from_user(®_val, uaddr, KVM_REG_SIZE(reg->id)))
492
490
return -EFAULT;
···
515
507
unsigned long *out_val)
516
508
{
517
509
struct kvm_vcpu_csr *csr = &vcpu->arch.guest_csr;
510
+
unsigned long regs_max = sizeof(struct kvm_riscv_csr) / sizeof(unsigned long);
518
511
519
-
if (reg_num >= sizeof(struct kvm_riscv_csr) / sizeof(unsigned long))
512
+
if (reg_num >= regs_max)
520
513
return -ENOENT;
514
+
515
+
reg_num = array_index_nospec(reg_num, regs_max);
521
516
522
517
if (reg_num == KVM_REG_RISCV_CSR_REG(sip)) {
523
518
kvm_riscv_vcpu_flush_interrupts(vcpu);
···
537
526
unsigned long reg_val)
538
527
{
539
528
struct kvm_vcpu_csr *csr = &vcpu->arch.guest_csr;
529
+
unsigned long regs_max = sizeof(struct kvm_riscv_csr) / sizeof(unsigned long);
540
530
541
-
if (reg_num >= sizeof(struct kvm_riscv_csr) / sizeof(unsigned long))
531
+
if (reg_num >= regs_max)
542
532
return -ENOENT;
533
+
534
+
reg_num = array_index_nospec(reg_num, regs_max);
543
535
544
536
if (reg_num == KVM_REG_RISCV_CSR_REG(sip)) {
545
537
reg_val &= VSIP_VALID_MASK;
···
562
548
unsigned long reg_val)
563
549
{
564
550
struct kvm_vcpu_smstateen_csr *csr = &vcpu->arch.smstateen_csr;
551
+
unsigned long regs_max = sizeof(struct kvm_riscv_smstateen_csr) /
552
+
sizeof(unsigned long);
565
553
566
-
if (reg_num >= sizeof(struct kvm_riscv_smstateen_csr) /
567
-
sizeof(unsigned long))
554
+
if (reg_num >= regs_max)
568
555
return -EINVAL;
556
+
557
+
reg_num = array_index_nospec(reg_num, regs_max);
569
558
570
559
((unsigned long *)csr)[reg_num] = reg_val;
571
560
return 0;
···
579
562
unsigned long *out_val)
580
563
{
581
564
struct kvm_vcpu_smstateen_csr *csr = &vcpu->arch.smstateen_csr;
565
+
unsigned long regs_max = sizeof(struct kvm_riscv_smstateen_csr) /
566
+
sizeof(unsigned long);
582
567
583
-
if (reg_num >= sizeof(struct kvm_riscv_smstateen_csr) /
584
-
sizeof(unsigned long))
568
+
if (reg_num >= regs_max)
585
569
return -EINVAL;
570
+
571
+
reg_num = array_index_nospec(reg_num, regs_max);
586
572
587
573
*out_val = ((unsigned long *)csr)[reg_num];
588
574
return 0;