evmcs_field_offset() bounds-checks the guest-supplied field index against nr_evmcs_1_fields and then indexes vmcs_field_to_evmcs_1[] without an array_index_nospec() clamp, unlike its vmcs12 counterpart get_vmcs12_field_offset(). An enlightened VMREAD/VMWRITE from the guest can therefore speculatively read out of bounds of vmcs_field_to_evmcs_1[] past the bound check (Spectre v1). Clamp the index with array_index_nospec(), mirroring get_vmcs12_field_offset(). Signed-off-by: Amirmohammad Eftekhar --- arch/x86/kvm/vmx/hyperv_evmcs.h | 2 ++ 1 file changed, 2 insertions(+) diff --git a/arch/x86/kvm/vmx/hyperv_evmcs.h b/arch/x86/kvm/vmx/hyperv_evmcs.h index bc08fe405..052b62b8e 100644 --- a/arch/x86/kvm/vmx/hyperv_evmcs.h +++ b/arch/x86/kvm/vmx/hyperv_evmcs.h @@ -136,6 +136,8 @@ static __always_inline int evmcs_field_offset(unsigned long field, if (unlikely(index >= nr_evmcs_1_fields)) return -ENOENT; + index = array_index_nospec(index, nr_evmcs_1_fields); + evmcs_field = &vmcs_field_to_evmcs_1[index]; /* -- 2.54.0 (Apple Git-157)