diff options
| author | Zongmin Zhou <zhouzongmin@kylinos.cn> | 2026-07-15 11:08:18 +0800 |
|---|---|---|
| committer | Anup Patel <anup@brainfault.org> | 2026-07-15 18:06:16 +0530 |
| commit | 8d9c9b135b5c23de9811a8426257cbd2fa024a99 (patch) | |
| tree | b2d664f55b25019ce135981972bba3f50b505895 /arch/riscv/kvm/vcpu_vector.c | |
| parent | d024a0a7879e6f37c0152aacf6d8e37b214a1738 (diff) | |
| download | linux-next-8d9c9b135b5c23de9811a8426257cbd2fa024a99.tar.gz linux-next-8d9c9b135b5c23de9811a8426257cbd2fa024a99.zip | |
KVM: riscv: Fix Spectre-v1 in vector register access
User-controlled register indices from the ONE_REG ioctl are used to
index into the vector register buffer (v0..v31). Sanitize the calculated
offset with array_index_nospec() to prevent speculative out-of-bounds
access.
Signed-off-by: Zongmin Zhou <zhouzongmin@kylinos.cn>
Reviewed-by: Anup Patel <anup@brainfault.org>
Link: https://lore.kernel.org/r/20260715030818.75657-1-min_halo@163.com
Signed-off-by: Anup Patel <anup@brainfault.org>
Diffstat (limited to 'arch/riscv/kvm/vcpu_vector.c')
| -rw-r--r-- | arch/riscv/kvm/vcpu_vector.c | 14 |
1 files changed, 12 insertions, 2 deletions
diff --git a/arch/riscv/kvm/vcpu_vector.c b/arch/riscv/kvm/vcpu_vector.c index 62d2fb77bb9b..3708616e2c32 100644 --- a/arch/riscv/kvm/vcpu_vector.c +++ b/arch/riscv/kvm/vcpu_vector.c @@ -10,6 +10,7 @@ #include <linux/errno.h> #include <linux/err.h> #include <linux/kvm_host.h> +#include <linux/nospec.h> #include <linux/uaccess.h> #include <asm/cpufeature.h> #include <asm/kvm_isa.h> @@ -129,11 +130,20 @@ static int kvm_riscv_vcpu_vreg_addr(struct kvm_vcpu *vcpu, return -ENOENT; } } else if (reg_num <= KVM_REG_RISCV_VECTOR_REG(31)) { + unsigned long reg_offset; + if (reg_size != vlenb) return -EINVAL; WARN_ON(!cntx->vector.datap); - *reg_addr = cntx->vector.datap + - (reg_num - KVM_REG_RISCV_VECTOR_REG(0)) * vlenb; + /* + * The reg_num is derived from the userspace-provided ONE_REG + * id. Sanitize it with array_index_nospec() to prevent + * speculative out-of-bounds access to the vector register + * buffer (32 vector registers: v0..v31). + */ + reg_offset = array_index_nospec( + reg_num - KVM_REG_RISCV_VECTOR_REG(0), 32); + *reg_addr = cntx->vector.datap + reg_offset * vlenb; } else { return -ENOENT; } |