| 12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849 |
- From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
- From: Andrew Honig <[email protected]>
- Date: Wed, 10 Jan 2018 10:12:03 -0800
- Subject: [PATCH] KVM: x86: Add memory barrier on vmcs field lookup
- MIME-Version: 1.0
- Content-Type: text/plain; charset=UTF-8
- Content-Transfer-Encoding: 8bit
- commit 75f139aaf896d6fdeec2e468ddfa4b2fe469bf40 upstream.
- This adds a memory barrier when performing a lookup into
- the vmcs_field_to_offset_table. This is related to
- CVE-2017-5753.
- Signed-off-by: Andrew Honig <[email protected]>
- Reviewed-by: Jim Mattson <[email protected]>
- Signed-off-by: Paolo Bonzini <[email protected]>
- Signed-off-by: Greg Kroah-Hartman <[email protected]>
- Signed-off-by: Fabian Grünbichler <[email protected]>
- ---
- arch/x86/kvm/vmx.c | 12 ++++++++++--
- 1 file changed, 10 insertions(+), 2 deletions(-)
- diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
- index 146caacd8fdd..80732f87cac0 100644
- --- a/arch/x86/kvm/vmx.c
- +++ b/arch/x86/kvm/vmx.c
- @@ -883,8 +883,16 @@ static inline short vmcs_field_to_offset(unsigned long field)
- {
- BUILD_BUG_ON(ARRAY_SIZE(vmcs_field_to_offset_table) > SHRT_MAX);
-
- - if (field >= ARRAY_SIZE(vmcs_field_to_offset_table) ||
- - vmcs_field_to_offset_table[field] == 0)
- + if (field >= ARRAY_SIZE(vmcs_field_to_offset_table))
- + return -ENOENT;
- +
- + /*
- + * FIXME: Mitigation for CVE-2017-5753. To be replaced with a
- + * generic mechanism.
- + */
- + asm("lfence");
- +
- + if (vmcs_field_to_offset_table[field] == 0)
- return -ENOENT;
-
- return vmcs_field_to_offset_table[field];
- --
- 2.14.2
|
