From: Jan Beulich <jbeulich@suse.com>
Date: Mon, 3 Sep 2018 15:50:10 +0000 (+0200)
Subject: x86: assorted array_index_nospec() insertions
X-Git-Tag: archive/raspbian/4.14.0+80-gd101b417b7-1+rpi1^2~63^2~3341
X-Git-Url: https://dgit.raspbian.org/%22http:/www.example.com/cgi/%22https://%22%22/%22http:/www.example.com/cgi/%22https:/%22%22?a=commitdiff_plain;h=3f2002614af51dfd507168a1696658bac91155ce;p=xen.git

x86: assorted array_index_nospec() insertions

Don't chance having Spectre v1 (including BCBS) gadgets. In some of the
cases the insertions are more of precautionary nature rather than there
provably being a gadget, but I think we should err on the safe (secure)
side here.

Signed-off-by: Jan Beulich <jbeulich@suse.com>
Reviewed-by: Paul Durrant <paul.durrant@citrix.com>
Acked-by: Razvan Cojocaru <rcojocaru@bitdefender.com>
Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
---

diff --git a/xen/arch/x86/hvm/dm.c b/xen/arch/x86/hvm/dm.c
index 87d97d055f..2735146028 100644
--- a/xen/arch/x86/hvm/dm.c
+++ b/xen/arch/x86/hvm/dm.c
@@ -17,6 +17,7 @@
 #include <xen/event.h>
 #include <xen/guest_access.h>
 #include <xen/hypercall.h>
+#include <xen/nospec.h>
 #include <xen/sched.h>
 
 #include <asm/hap.h>
@@ -232,7 +233,7 @@ static int set_mem_type(struct domain *d,
                         struct xen_dm_op_set_mem_type *data)
 {
     xen_pfn_t last_pfn = data->first_pfn + data->nr - 1;
-    unsigned int iter = 0;
+    unsigned int iter = 0, mem_type;
     int rc = 0;
 
     /* Interface types to internal p2m types */
@@ -252,7 +253,9 @@ static int set_mem_type(struct domain *d,
          unlikely(data->mem_type == HVMMEM_unused) )
         return -EINVAL;
 
-    if ( data->mem_type  == HVMMEM_ioreq_server )
+    mem_type = array_index_nospec(data->mem_type, ARRAY_SIZE(memtype));
+
+    if ( mem_type == HVMMEM_ioreq_server )
     {
         unsigned int flags;
 
@@ -279,10 +282,10 @@ static int set_mem_type(struct domain *d,
 
         if ( p2m_is_shared(t) )
             rc = -EAGAIN;
-        else if ( !allow_p2m_type_change(t, memtype[data->mem_type]) )
+        else if ( !allow_p2m_type_change(t, memtype[mem_type]) )
             rc = -EINVAL;
         else
-            rc = p2m_change_type_one(d, pfn, t, memtype[data->mem_type]);
+            rc = p2m_change_type_one(d, pfn, t, memtype[mem_type]);
 
         put_gfn(d, pfn);
 
@@ -387,6 +390,8 @@ static int dm_op(const struct dmop_args *op_args)
         goto out;
     }
 
+    op.op = array_index_nospec(op.op, ARRAY_SIZE(op_size));
+
     if ( op_args->buf[0].size < offset + op_size[op.op] )
         goto out;
 
@@ -739,7 +744,7 @@ int compat_dm_op(domid_t domid,
         return -E2BIG;
 
     args.domid = domid;
-    args.nr_bufs = nr_bufs;
+    args.nr_bufs = array_index_nospec(nr_bufs, ARRAY_SIZE(args.buf) + 1);
 
     for ( i = 0; i < args.nr_bufs; i++ )
     {
@@ -776,7 +781,7 @@ long do_dm_op(domid_t domid,
         return -E2BIG;
 
     args.domid = domid;
-    args.nr_bufs = nr_bufs;
+    args.nr_bufs = array_index_nospec(nr_bufs, ARRAY_SIZE(args.buf) + 1);
 
     if ( copy_from_guest_offset(&args.buf[0], bufs, 0, args.nr_bufs) )
         return -EFAULT;
diff --git a/xen/arch/x86/hvm/hypercall.c b/xen/arch/x86/hvm/hypercall.c
index 3d7ac49b33..56713d1e08 100644
--- a/xen/arch/x86/hvm/hypercall.c
+++ b/xen/arch/x86/hvm/hypercall.c
@@ -20,6 +20,7 @@
  */
 #include <xen/lib.h>
 #include <xen/hypercall.h>
+#include <xen/nospec.h>
 
 #include <asm/hvm/support.h>
 
@@ -181,8 +182,15 @@ int hvm_hypercall(struct cpu_user_regs *regs)
     BUILD_BUG_ON(ARRAY_SIZE(hvm_hypercall_table) >
                  ARRAY_SIZE(hypercall_args_table));
 
-    if ( (eax >= ARRAY_SIZE(hvm_hypercall_table)) ||
-         !hvm_hypercall_table[eax].native )
+    if ( eax >= ARRAY_SIZE(hvm_hypercall_table) )
+    {
+        regs->rax = -ENOSYS;
+        return HVM_HCALL_completed;
+    }
+
+    eax = array_index_nospec(eax, ARRAY_SIZE(hvm_hypercall_table));
+
+    if ( !hvm_hypercall_table[eax].native )
     {
         regs->rax = -ENOSYS;
         return HVM_HCALL_completed;
diff --git a/xen/arch/x86/mm/mem_access.c b/xen/arch/x86/mm/mem_access.c
index 84d260ebd8..a8b3e99ec4 100644
--- a/xen/arch/x86/mm/mem_access.c
+++ b/xen/arch/x86/mm/mem_access.c
@@ -23,6 +23,7 @@
 
 #include <xen/guest_access.h> /* copy_from_guest() */
 #include <xen/mem_access.h>
+#include <xen/nospec.h>
 #include <xen/vm_event.h>
 #include <xen/event.h>
 #include <public/vm_event.h>
@@ -336,6 +337,7 @@ static bool xenmem_access_to_p2m_access(struct p2m_domain *p2m,
     switch ( xaccess )
     {
     case 0 ... ARRAY_SIZE(memaccess) - 1:
+        xaccess = array_index_nospec(xaccess, ARRAY_SIZE(memaccess));
         *paccess = memaccess[xaccess];
         break;
     case XENMEM_access_default:
diff --git a/xen/arch/x86/pv/hypercall.c b/xen/arch/x86/pv/hypercall.c
index 7f42b40d7f..5d11911735 100644
--- a/xen/arch/x86/pv/hypercall.c
+++ b/xen/arch/x86/pv/hypercall.c
@@ -21,6 +21,7 @@
 
 #include <xen/compiler.h>
 #include <xen/hypercall.h>
+#include <xen/nospec.h>
 #include <xen/trace.h>
 
 #define HYPERCALL(x)                                                \
@@ -101,8 +102,15 @@ void pv_hypercall(struct cpu_user_regs *regs)
     BUILD_BUG_ON(ARRAY_SIZE(pv_hypercall_table) >
                  ARRAY_SIZE(hypercall_args_table));
 
-    if ( (eax >= ARRAY_SIZE(pv_hypercall_table)) ||
-         !pv_hypercall_table[eax].native )
+    if ( eax >= ARRAY_SIZE(pv_hypercall_table) )
+    {
+        regs->rax = -ENOSYS;
+        return;
+    }
+
+    eax = array_index_nospec(eax, ARRAY_SIZE(pv_hypercall_table));
+
+    if ( !pv_hypercall_table[eax].native )
     {
         regs->rax = -ENOSYS;
         return;