Re: [PATCH] KVM: x86: use array_index_nospec with indices that come from guest

[Sean Christopherson <seanjc@google.com>]

On Thu, Jul 24, 2025, Greg Kroah-Hartman wrote:
> From: Thijs Raymakers <thijs@raymakers.nl>
> 
> min and dest_id are guest-controlled indices. Using array_index_nospec()
> after the bounds checks clamps these values to mitigate speculative
> execution side-channels.
> 
> Signed-off-by: Thijs Raymakers <thijs@raymakers.nl>
> Cc: stable <stable@kernel.org>
> Cc: Sean Christopherson <seanjc@google.com>
> Cc: Paolo Bonzini <pbonzini@redhat.com>
> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> ---
>  arch/x86/kvm/lapic.c | 2 ++
>  arch/x86/kvm/x86.c   | 7 +++++--
>  2 files changed, 7 insertions(+), 2 deletions(-)
> 
> diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c
> index 73418dc0ebb2..e10d6ad236c9 100644
> --- a/arch/x86/kvm/lapic.c
> +++ b/arch/x86/kvm/lapic.c
> @@ -852,6 +852,8 @@ static int __pv_send_ipi(unsigned long *ipi_bitmap, struct kvm_apic_map *map,
>  	if (min > map->max_apic_id)
>  		return 0;
>  
> +	min = array_index_nospec(min, map->max_apic_id);

This is wrong, max_apic_id is inclusive, whereas array_index_nospec() takes a
size/length as the second argument.  I.e. this needs to be:

	min = array_index_nospec(min, map->max_apic_id + 1);

> +
>  	for_each_set_bit(i, ipi_bitmap,
>  		min((u32)BITS_PER_LONG, (map->max_apic_id - min + 1))) {
>  		if (map->phys_map[min + i]) {
> diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
> index 93636f77c42d..872e43defa67 100644
> --- a/arch/x86/kvm/x86.c
> +++ b/arch/x86/kvm/x86.c
> @@ -10051,8 +10051,11 @@ static void kvm_sched_yield(struct kvm_vcpu *vcpu, unsigned long dest_id)
>  	rcu_read_lock();
>  	map = rcu_dereference(vcpu->kvm->arch.apic_map);
>  
> -	if (likely(map) && dest_id <= map->max_apic_id && map->phys_map[dest_id])
> -		target = map->phys_map[dest_id]->vcpu;
> +	if (likely(map) && dest_id <= map->max_apic_id) {
> +		dest_id = array_index_nospec(dest_id, map->max_apic_id);

Same thing here.

> +		if (map->phys_map[dest_id])
> +			target = map->phys_map[dest_id]->vcpu;
> +	}
>  
>  	rcu_read_unlock();
>  
> -- 
> 2.50.1
>