KVM: s390: Fix potential spectre warnings

PATCH Applied Eric Farman 5 participants 9 messages Apr 17, 2019 – Apr 18, 2019

Subsystems (3)

KVM s390 KVM s390

lore

Share & tools

lore

Eric Farman

author

2019-04-17 00:54 UTC #0 lore raw

PATCH 1/1 KVM: s390: Fix potential spectre warnings

Fix some warnings from smatch:

arch/s390/kvm/interrupt.c:2310 get_io_adapter() warn: potential spectre issue 'kvm->arch.adapters' [r] (local cap) arch/s390/kvm/interrupt.c:2341 register_io_adapter() warn: potential spectre issue 'dev->kvm->arch.adapters' [w]

Signed-off-by Eric Farman <[email protected]>

---
A recent patch from Paolo [1] acted as a reminder (thanks, Christian!) that I had one for the s390 KVM code after some code reviews [2]. Let's clean that up.

[1] https://patchwork.kernel.org/patch/10895463/
[2] https://patchwork.kernel.org/patch/10788565/#22484223

---
 arch/s390/kvm/interrupt.c | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

arch/s390/kvm/interrupt.c +9 -2

index 82162867f378..bfd55ad34a3e 100644
@@ -14,6 +14,7 @@
 #include <linux/kvm_host.h>
 #include <linux/hrtimer.h>
 #include <linux/mmu_context.h>
+#include <linux/nospec.h>
 #include <linux/signal.h>
 #include <linux/slab.h>
 #include <linux/bitmap.h>

@@ -2307,6 +2308,7 @@ static struct s390_io_adapter *get_io_adapter(struct kvm *kvm, unsigned int id)
 {
 	if (id >= MAX_S390_IO_ADAPTERS)
 		return NULL;
+	id = array_index_nospec(id, MAX_S390_IO_ADAPTERS);
 	return kvm->arch.adapters[id];
 }

@@ -2320,8 +2322,13 @@ static int register_io_adapter(struct kvm_device *dev,
 			   (void __user *)attr->addr, sizeof(adapter_info)))
 		return -EFAULT;
 
-	if ((adapter_info.id >= MAX_S390_IO_ADAPTERS) ||
-	    (dev->kvm->arch.adapters[adapter_info.id] != NULL))
+	if (adapter_info.id >= MAX_S390_IO_ADAPTERS)
+		return -EINVAL;
+
+	adapter_info.id = array_index_nospec(adapter_info.id,
+					     MAX_S390_IO_ADAPTERS);
+
+	if (dev->kvm->arch.adapters[adapter_info.id] != NULL)
 		return -EINVAL;
 
 	adapter = kzalloc(sizeof(*adapter), GFP_KERNEL);

Signature · 1 line

2.16.4

David Hildenbrand

2019-04-17 07:49 UTC #1 lore raw

Quoted 30 lines · Eric Farman

Fix some warnings from smatch:
arch/s390/kvm/interrupt.c:2310 get_io_adapter() warn: potential spectre issue 'kvm->arch.adapters' [r] (local cap) arch/s390/kvm/interrupt.c:2341 register_io_adapter() warn: potential spectre issue 'dev->kvm->arch.adapters' [w]
Signed-off-by Eric Farman <[email protected]>
---
A recent patch from Paolo [1] acted as a reminder (thanks, Christian!) that I had one for the s390 KVM code after some code reviews [2]. Let's clean that up.
[1] https://patchwork.kernel.org/patch/10895463/
[2] https://patchwork.kernel.org/patch/10788565/#22484223
---
 arch/s390/kvm/interrupt.c | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)
arch/s390/kvm/interrupt.c +1 -0
index 82162867f378..bfd55ad34a3e 100644
@@ -14,6 +14,7 @@
 #include <linux/kvm_host.h>
 #include <linux/hrtimer.h>
 #include <linux/mmu_context.h>
+#include <linux/nospec.h>
 #include <linux/signal.h>
 #include <linux/slab.h>
 #include <linux/bitmap.h>

arch/s390/kvm/interrupt.c static struct s390_io_adapter *get_io_adapter(struct kvm *kvm, unsigned int id) · line 2312

Quoted 5 lines

arch/s390/kvm/interrupt.c +1 -0

@@ -2307,6 +2308,7 @@ static struct s390_io_adapter *get_io_adapter(struct kvm *kvm, unsigned int id)
 {
 	if (id >= MAX_S390_IO_ADAPTERS)
 		return NULL;
+	id = array_index_nospec(id, MAX_S390_IO_ADAPTERS);
 	return kvm->arch.adapters[id];

return kvm->arch.adapters[array_index_nospec(id, MAX_S390_IO_ADAPTERS)];

should exactly fit into a single line if I am not wrong.

arch/s390/kvm/interrupt.c static int register_io_adapter(struct kvm_device *dev, · line 2329

Quoted 13 lines

arch/s390/kvm/interrupt.c +5 -2

@@ -2320,8 +2322,13 @@ static int register_io_adapter(struct kvm_device *dev,
 			   (void __user *)attr->addr, sizeof(adapter_info)))
 		return -EFAULT;
 
-	if ((adapter_info.id >= MAX_S390_IO_ADAPTERS) ||
-	    (dev->kvm->arch.adapters[adapter_info.id] != NULL))
+	if (adapter_info.id >= MAX_S390_IO_ADAPTERS)
+		return -EINVAL;
+
+	adapter_info.id = array_index_nospec(adapter_info.id,
+					     MAX_S390_IO_ADAPTERS);

I dislike that we are modifying adapter_info here. Can you use a local variable instead?

Quoted 6 lines

arch/s390/kvm/interrupt.c +2 -0

+
+	if (dev->kvm->arch.adapters[adapter_info.id] != NULL)
 		return -EINVAL;
 
 	adapter = kzalloc(sizeof(*adapter), GFP_KERNEL);

Signature · 3 lines

Thanks,

David / dhildenb

Paolo Bonzini

maintainer

2019-04-17 13:13 UTC #2 lore raw

Quoted 3 lines · David Hildenbrand

return kvm->arch.adapters[array_index_nospec(id, MAX_S390_IO_ADAPTERS)];
should exactly fit into a single line if I am not wrong.

git grep "\\[.*array_index_nospec" suggests that the preferred idiom is

var = array_index_nospec(var, SIZE)

which makes sense since it sanitizes var once and for all.

Paolo

Eric Farman

author

2019-04-17 14:23 UTC #3 lore raw

In reply to David Hildenbrand

Quoted 39 lines · David Hildenbrand

Quoted 30 lines · Eric Farman
Fix some warnings from smatch:
arch/s390/kvm/interrupt.c:2310 get_io_adapter() warn: potential spectre issue 'kvm->arch.adapters' [r] (local cap) arch/s390/kvm/interrupt.c:2341 register_io_adapter() warn: potential spectre issue 'dev->kvm->arch.adapters' [w]
Signed-off-by Eric Farman <[email protected]>
---
A recent patch from Paolo [1] acted as a reminder (thanks, Christian!) that I had one for the s390 KVM code after some code reviews [2]. Let's clean that up.
[1] https://patchwork.kernel.org/patch/10895463/
[2] https://patchwork.kernel.org/patch/10788565/#22484223
---
  arch/s390/kvm/interrupt.c | 11 +++++++++--
  1 file changed, 9 insertions(+), 2 deletions(-)
arch/s390/kvm/interrupt.c +1 -0
index 82162867f378..bfd55ad34a3e 100644
@@ -14,6 +14,7 @@
  #include <linux/kvm_host.h>
  #include <linux/hrtimer.h>
  #include <linux/mmu_context.h>
+#include <linux/nospec.h>
  #include <linux/signal.h>
  #include <linux/slab.h>
  #include <linux/bitmap.h>
arch/s390/kvm/interrupt.c static struct s390_io_adapter *get_io_adapter(struct kvm *kvm, unsigned int id) · line 2312
Quoted 5 lines
arch/s390/kvm/interrupt.c +1 -0
@@ -2307,6 +2308,7 @@ static struct s390_io_adapter *get_io_adapter(struct kvm *kvm, unsigned int id)
  {
  	if (id >= MAX_S390_IO_ADAPTERS)
  		return NULL;
+	id = array_index_nospec(id, MAX_S390_IO_ADAPTERS);
  	return kvm->arch.adapters[id];
return kvm->arch.adapters[array_index_nospec(id, MAX_S390_IO_ADAPTERS)];

Quoted 1 line

should exactly fit into a single line if I am not wrong.

Yeah, just. As Paolo pointed out, that's not common usage. Though of the four other hits I see, only one of them is the same as this instance, in that "id" is passed as a variable and then we immediately return with an array entry (even if NULL) rather than doing something else in that function. So maybe all-in-one-line here is a little cleaner.

Quoted 7 lines

arch/s390/kvm/interrupt.c +0 -0

@@ -2320,8 +2322,13 @@ static int register_io_adapter(struct kvm_device *dev,
  			   (void __user *)attr->addr, sizeof(adapter_info)))
  		return -EFAULT;

Quoted 10 lines

arch/s390/kvm/interrupt.c static int register_io_adapter(struct kvm_device *dev, · line 2329
Quoted 7 lines
arch/s390/kvm/interrupt.c +5 -2
-	if ((adapter_info.id >= MAX_S390_IO_ADAPTERS) ||
-	    (dev->kvm->arch.adapters[adapter_info.id] != NULL))
+	if (adapter_info.id >= MAX_S390_IO_ADAPTERS)
+		return -EINVAL;
+
+	adapter_info.id = array_index_nospec(adapter_info.id,
+					     MAX_S390_IO_ADAPTERS);
I dislike that we are modifying adapter_info here. Can you use a local variable instead?

I guess, but adapter_info is a local variable too. So sanitization this way seems fine to me. But if you dislike it more than I don't care, I'll add another local variable. :)

Quoted 8 lines

Quoted 7 lines

arch/s390/kvm/interrupt.c +2 -0

+
+	if (dev->kvm->arch.adapters[adapter_info.id] != NULL)
  		return -EINVAL;
 
  	adapter = kzalloc(sizeof(*adapter), GFP_KERNEL);

David Hildenbrand

Reviewed-by

2019-04-17 14:24 UTC #4 lore raw

Quoted 68 lines · Eric Farman

Quoted 39 lines · David Hildenbrand
Quoted 30 lines · Eric Farman
Fix some warnings from smatch:
arch/s390/kvm/interrupt.c:2310 get_io_adapter() warn: potential spectre issue 'kvm->arch.adapters' [r] (local cap) arch/s390/kvm/interrupt.c:2341 register_io_adapter() warn: potential spectre issue 'dev->kvm->arch.adapters' [w]
Signed-off-by Eric Farman <[email protected]>
---
A recent patch from Paolo [1] acted as a reminder (thanks, Christian!) that I had one for the s390 KVM code after some code reviews [2]. Let's clean that up.
[1] https://patchwork.kernel.org/patch/10895463/
[2] https://patchwork.kernel.org/patch/10788565/#22484223
---
  arch/s390/kvm/interrupt.c | 11 +++++++++--
  1 file changed, 9 insertions(+), 2 deletions(-)
arch/s390/kvm/interrupt.c +1 -0
index 82162867f378..bfd55ad34a3e 100644
@@ -14,6 +14,7 @@
  #include <linux/kvm_host.h>
  #include <linux/hrtimer.h>
  #include <linux/mmu_context.h>
+#include <linux/nospec.h>
  #include <linux/signal.h>
  #include <linux/slab.h>
  #include <linux/bitmap.h>
arch/s390/kvm/interrupt.c static struct s390_io_adapter *get_io_adapter(struct kvm *kvm, unsigned int id) · line 2312
Quoted 5 lines
arch/s390/kvm/interrupt.c +1 -0
@@ -2307,6 +2308,7 @@ static struct s390_io_adapter *get_io_adapter(struct kvm *kvm, unsigned int id)
  {
  	if (id >= MAX_S390_IO_ADAPTERS)
  		return NULL;
+	id = array_index_nospec(id, MAX_S390_IO_ADAPTERS);
  	return kvm->arch.adapters[id];
return kvm->arch.adapters[array_index_nospec(id, MAX_S390_IO_ADAPTERS)];
Quoted 1 line
should exactly fit into a single line if I am not wrong.
Yeah, just. As Paolo pointed out, that's not common usage. Though of the four other hits I see, only one of them is the same as this instance, in that "id" is passed as a variable and then we immediately return with an array entry (even if NULL) rather than doing something else in that function. So maybe all-in-one-line here is a little cleaner.
Quoted 7 lines
Quoted 7 lines
arch/s390/kvm/interrupt.c +0 -0
  }
 
@@ -2320,8 +2322,13 @@ static int register_io_adapter(struct kvm_device *dev,
  			   (void __user *)attr->addr, sizeof(adapter_info)))
  		return -EFAULT;
 
Quoted 10 lines
arch/s390/kvm/interrupt.c static int register_io_adapter(struct kvm_device *dev, · line 2329
Quoted 7 lines
arch/s390/kvm/interrupt.c +5 -2
-	if ((adapter_info.id >= MAX_S390_IO_ADAPTERS) ||
-	    (dev->kvm->arch.adapters[adapter_info.id] != NULL))
+	if (adapter_info.id >= MAX_S390_IO_ADAPTERS)
+		return -EINVAL;
+
+	adapter_info.id = array_index_nospec(adapter_info.id,
+					     MAX_S390_IO_ADAPTERS);
I dislike that we are modifying adapter_info here. Can you use a local variable instead?

Quoted 3 lines

I guess, but adapter_info is a local variable too. So sanitization this way seems fine to me. But if you dislike it more than I don't care, I'll add another local variable. :)

Oh right, I was confused, sorry. All fine.

Reviewed-by David Hildenbrand <[email protected]>

Signature · 3 lines

Thanks,

David / dhildenb

Paolo Bonzini

maintainer

2019-04-17 13:09 UTC #5 lore raw

In reply to Eric Farman

Quoted 10 lines · Eric Farman

Fix some warnings from smatch:
arch/s390/kvm/interrupt.c:2310 get_io_adapter() warn: potential spectre issue 'kvm->arch.adapters' [r] (local cap) arch/s390/kvm/interrupt.c:2341 register_io_adapter() warn: potential spectre issue 'dev->kvm->arch.adapters' [w]
Signed-off-by Eric Farman <[email protected]>
---
A recent patch from Paolo [1] acted as a reminder (thanks, Christian!) that I had one for the s390 KVM code after some code reviews [2]. Let's clean that up.

Spectrev1 is a gift that keeps on giving... I suppose Christian will queue this one and I don't have anything to do here.

Paolo

Christian Borntraeger

2019-04-17 13:10 UTC #6 lore raw

Quoted 6 lines · Paolo Bonzini

Quoted 5 lines · Eric Farman
Fix some warnings from smatch:
arch/s390/kvm/interrupt.c:2310 get_io_adapter() warn: potential spectre issue 'kvm->arch.adapters' [r] (local cap) arch/s390/kvm/interrupt.c:2341 register_io_adapter() warn: potential spectre issue 'dev->kvm->arch.adapters' [w]

Quoted 8 lines

Quoted 5 lines
Signed-off-by Eric Farman <[email protected]>
---
A recent patch from Paolo [1] acted as a reminder (thanks, Christian!) that I had one for the s390 KVM code after some code reviews [2]. Let's clean that up.
Spectrev1 is a gift that keeps on giving... I suppose Christian will queue this one and I don't have anything to do here.

Yes, will just wait until the review has settled.

Christian Borntraeger

Applied

2019-04-18 07:19 UTC #7 lore raw

In reply to Eric Farman

Quoted 5 lines · Eric Farman

Fix some warnings from smatch:
arch/s390/kvm/interrupt.c:2310 get_io_adapter() warn: potential spectre issue 'kvm->arch.adapters' [r] (local cap) arch/s390/kvm/interrupt.c:2341 register_io_adapter() warn: potential spectre issue 'dev->kvm->arch.adapters' [w]

Quoted 8 lines

Signed-off-by Eric Farman <[email protected]>
---
A recent patch from Paolo [1] acted as a reminder (thanks, Christian!) that I had one for the s390 KVM code after some code reviews [2]. Let's clean that up.
[1] https://patchwork.kernel.org/patch/10895463/
[2] https://patchwork.kernel.org/patch/10788565/#22484223

Thanks applied.

Cornelia Huck

Reviewed-by on v1 1/1

2019-04-18 08:02 UTC #8 lore raw

In reply to Eric Farman

Quoted 11 lines · On Wed, 17 Apr 2019 02:54:14 +0200 Eric Farman <[email protected]> wrote:

Fix some warnings from smatch:
arch/s390/kvm/interrupt.c:2310 get_io_adapter() warn: potential spectre issue 'kvm->arch.adapters' [r] (local cap) arch/s390/kvm/interrupt.c:2341 register_io_adapter() warn: potential spectre issue 'dev->kvm->arch.adapters' [w]
Signed-off-by Eric Farman <[email protected]>
---
A recent patch from Paolo [1] acted as a reminder (thanks, Christian!) that I had one for the s390 KVM code after some code reviews [2]. Let's clean that up.

Quoted 5 lines

[1] https://patchwork.kernel.org/patch/10895463/
[2] https://patchwork.kernel.org/patch/10788565/#22484223
---
 arch/s390/kvm/interrupt.c | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

Reviewed-by Cornelia Huck <[email protected]>