From: Amirmohammad Eftekhar evmcs_field_offset() bounds-checks the guest-supplied field index against nr_evmcs_1_fields and then indexes vmcs_field_to_evmcs_1[] with it, but, unlike its vmcs12 counterpart get_vmcs12_field_offset(), it does not clamp the index with array_index_nospec() after the check. The field index is derived from a guest-supplied VMCS field encoding on the enlightened VMREAD/VMWRITE path, so the array access can be performed speculatively past the bounds check (Spectre v1), disclosing memory adjacent to vmcs_field_to_evmcs_1[]. Clamp the index with array_index_nospec() immediately after the bounds check, mirroring get_vmcs12_field_offset(). Signed-off-by: Amirmohammad Eftekhar --- arch/x86/kvm/vmx/hyperv_evmcs.h | 2 ++ 1 file changed, 2 insertions(+) diff --git a/arch/x86/kvm/vmx/hyperv_evmcs.h b/arch/x86/kvm/vmx/hyperv_evmcs.h index bc08fe40590e..052b62b8ed8e 100644 --- a/arch/x86/kvm/vmx/hyperv_evmcs.h +++ b/arch/x86/kvm/vmx/hyperv_evmcs.h @@ -136,6 +136,8 @@ static __always_inline int evmcs_field_offset(unsigned long field, if (unlikely(index >= nr_evmcs_1_fields)) return -ENOENT; + index = array_index_nospec(index, nr_evmcs_1_fields); + evmcs_field = &vmcs_field_to_evmcs_1[index]; /* -- 2.43.0