[Xen-changelog] [xen stable-4.8] x86: assorted array_index_nospec() insertions

[patchbot@xxxxxxx]

commit 005df911f6b4171b650942861bf44606e9e79be4
Author:     Jan Beulich <jbeulich@xxxxxxxx>
AuthorDate: Fri Sep 14 13:36:32 2018 +0200
Commit:     Jan Beulich <jbeulich@xxxxxxxx>
CommitDate: Fri Sep 14 13:36:32 2018 +0200

    x86: assorted array_index_nospec() insertions
    
    Don't chance having Spectre v1 (including BCBS) gadgets. In some of the
    cases the insertions are more of precautionary nature rather than there
    provably being a gadget, but I think we should err on the safe (secure)
    side here.
    
    Signed-off-by: Jan Beulich <jbeulich@xxxxxxxx>
    Reviewed-by: Paul Durrant <paul.durrant@xxxxxxxxxx>
    Acked-by: Razvan Cojocaru <rcojocaru@xxxxxxxxxxxxxxx>
    Reviewed-by: Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
    master commit: 3f2002614af51dfd507168a1696658bac91155ce
    master date: 2018-09-03 17:50:10 +0200
---
 xen/arch/x86/hvm/hvm.c   | 22 ++++++++++++++++------
 xen/arch/x86/hypercall.c | 12 ++++++++++--
 xen/arch/x86/mm/p2m.c    |  2 ++
 3 files changed, 28 insertions(+), 8 deletions(-)

diff --git a/xen/arch/x86/hvm/hvm.c b/xen/arch/x86/hvm/hvm.c
index 3e74616185..4cf9b52c62 100644
--- a/xen/arch/x86/hvm/hvm.c
+++ b/xen/arch/x86/hvm/hvm.c
@@ -30,6 +30,7 @@
 #include <xen/domain_page.h>
 #include <xen/hypercall.h>
 #include <xen/guest_access.h>
+#include <xen/nospec.h>
 #include <xen/event.h>
 #include <xen/cpu.h>
 #include <xen/wait.h>
@@ -4474,8 +4475,15 @@ int hvm_do_hypercall(struct cpu_user_regs *regs)
     BUILD_BUG_ON(ARRAY_SIZE(hvm_hypercall_table) >
                  ARRAY_SIZE(hypercall_args_table));
 
-    if ( (eax >= ARRAY_SIZE(hvm_hypercall_table)) ||
-         !hvm_hypercall_table[eax].native )
+    if ( eax >= ARRAY_SIZE(hvm_hypercall_table) )
+    {
+        regs->eax = -ENOSYS;
+        return HVM_HCALL_completed;
+    }
+
+    eax = array_index_nospec(eax, ARRAY_SIZE(hvm_hypercall_table));
+
+    if ( !hvm_hypercall_table[eax].native )
     {
         regs->eax = -ENOSYS;
         return HVM_HCALL_completed;
@@ -5766,6 +5774,7 @@ static int hvmop_set_mem_type(
     unsigned long start_iter = *iter;
     struct xen_hvm_set_mem_type a;
     struct domain *d;
+    unsigned int mem_type;
     int rc;
 
     /* Interface types to internal p2m types */
@@ -5798,8 +5807,9 @@ static int hvmop_set_mem_type(
          ((a.first_pfn + a.nr - 1) > domain_get_maximum_gpfn(d)) )
         goto out;
 
-    if ( a.hvmmem_type >= ARRAY_SIZE(memtype) ||
-         unlikely(a.hvmmem_type == HVMMEM_unused) )
+    mem_type = array_index_nospec(a.hvmmem_type, ARRAY_SIZE(memtype));
+    if ( mem_type >= ARRAY_SIZE(memtype) ||
+         unlikely(mem_type == HVMMEM_unused) )
         goto out;
 
     while ( a.nr > start_iter )
@@ -5821,13 +5831,13 @@ static int hvmop_set_mem_type(
             rc = -EAGAIN;
             goto out;
         }
-        if ( !hvm_allow_p2m_type_change(t, memtype[a.hvmmem_type]) )
+        if ( !hvm_allow_p2m_type_change(t, memtype[mem_type]) )
         {
             put_gfn(d, pfn);
             goto out;
         }
 
-        rc = p2m_change_type_one(d, pfn, t, memtype[a.hvmmem_type]);
+        rc = p2m_change_type_one(d, pfn, t, memtype[mem_type]);
         put_gfn(d, pfn);
 
         if ( rc )
diff --git a/xen/arch/x86/hypercall.c b/xen/arch/x86/hypercall.c
index 30230414a6..be6723418c 100644
--- a/xen/arch/x86/hypercall.c
+++ b/xen/arch/x86/hypercall.c
@@ -19,6 +19,7 @@
 
 #include <xen/compiler.h>
 #include <xen/hypercall.h>
+#include <xen/nospec.h>
 #include <xen/trace.h>
 
 #define ARGS(x, n)                              \
@@ -151,8 +152,15 @@ void pv_hypercall(struct cpu_user_regs *regs)
     BUILD_BUG_ON(ARRAY_SIZE(pv_hypercall_table) >
                  ARRAY_SIZE(hypercall_args_table));
 
-    if ( (eax >= ARRAY_SIZE(pv_hypercall_table)) ||
-         !pv_hypercall_table[eax].native )
+    if ( eax >= ARRAY_SIZE(pv_hypercall_table) )
+    {
+        regs->eax = -ENOSYS;
+        return;
+    }
+
+    eax = array_index_nospec(eax, ARRAY_SIZE(pv_hypercall_table));
+
+    if ( !pv_hypercall_table[eax].native )
     {
         regs->eax = -ENOSYS;
         return;
diff --git a/xen/arch/x86/mm/p2m.c b/xen/arch/x86/mm/p2m.c
index a86dd8156f..239f8e882b 100644
--- a/xen/arch/x86/mm/p2m.c
+++ b/xen/arch/x86/mm/p2m.c
@@ -25,6 +25,7 @@
 
 #include <xen/guest_access.h> /* copy_from_guest() */
 #include <xen/iommu.h>
+#include <xen/nospec.h>
 #include <xen/vm_event.h>
 #include <xen/event.h>
 #include <public/vm_event.h>
@@ -1839,6 +1840,7 @@ static bool xenmem_access_to_p2m_access(struct p2m_domain 
*p2m,
     switch ( xaccess )
     {
     case 0 ... ARRAY_SIZE(memaccess) - 1:
+        xaccess = array_index_nospec(xaccess, ARRAY_SIZE(memaccess));
         *paccess = memaccess[xaccess];
         break;
     case XENMEM_access_default:
--
generated by git-patchbot for /home/xen/git/xen.git#stable-4.8

_______________________________________________
Xen-changelog mailing list
Xen-changelog@xxxxxxxxxxxxxxxxxxxx
https://lists.xenproject.org/xen-changelog