From f8303458ae80062dfc60d0efd36198cc17a12ecf Mon Sep 17 00:00:00 2001 From: Norbert Manthey Date: Thu, 14 Mar 2019 13:57:00 +0100 Subject: [PATCH] common/domain: block speculative out-of-bound accesses When issuing a vcpu_op hypercall, guests have control over the vcpuid variable. In the old code, this allowed to perform speculative out-of-bound accesses. To block this, we make use of the domain_vcpu function. This is part of the speculative hardening effort. Signed-off-by: Norbert Manthey Reviewed-by: Jan Beulich --- xen/common/domain.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/xen/common/domain.c b/xen/common/domain.c index a1f8bb4f2f..88bbe984bc 100644 --- a/xen/common/domain.c +++ b/xen/common/domain.c @@ -1364,7 +1364,7 @@ long do_vcpu_op(int cmd, unsigned int vcpuid, XEN_GUEST_HANDLE_PARAM(void) arg) struct vcpu *v; long rc = 0; - if ( vcpuid >= d->max_vcpus || (v = d->vcpu[vcpuid]) == NULL ) + if ( (v = domain_vcpu(d, vcpuid)) == NULL ) return -ENOENT; switch ( cmd ) -- 2.30.2