diff options
author | Paolo Bonzini <pbonzini@redhat.com> | 2019-04-11 11:16:47 +0200 |
---|---|---|
committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2019-05-16 19:41:22 +0200 |
commit | d39f3cc71382165bb7efb8e06a2bd32f847de4ae (patch) | |
tree | 4572f5a2da9c28e3fac0f9f6919d695529eedf97 /include/linux | |
parent | 4074bc379b1f8d1f7300a52de4d62bff55987a57 (diff) | |
download | linux-stable-d39f3cc71382165bb7efb8e06a2bd32f847de4ae.tar.gz linux-stable-d39f3cc71382165bb7efb8e06a2bd32f847de4ae.tar.bz2 linux-stable-d39f3cc71382165bb7efb8e06a2bd32f847de4ae.zip |
KVM: fix spectrev1 gadgets
[ Upstream commit 1d487e9bf8ba66a7174c56a0029c54b1eca8f99c ]
These were found with smatch, and then generalized when applicable.
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Diffstat (limited to 'include/linux')
-rw-r--r-- | include/linux/kvm_host.h | 10 |
1 files changed, 6 insertions, 4 deletions
diff --git a/include/linux/kvm_host.h b/include/linux/kvm_host.h index 23c242a7ac52..30efb3663892 100644 --- a/include/linux/kvm_host.h +++ b/include/linux/kvm_host.h @@ -28,6 +28,7 @@ #include <linux/irqbypass.h> #include <linux/swait.h> #include <linux/refcount.h> +#include <linux/nospec.h> #include <asm/signal.h> #include <linux/kvm.h> @@ -491,10 +492,10 @@ static inline struct kvm_io_bus *kvm_get_bus(struct kvm *kvm, enum kvm_bus idx) static inline struct kvm_vcpu *kvm_get_vcpu(struct kvm *kvm, int i) { - /* Pairs with smp_wmb() in kvm_vm_ioctl_create_vcpu, in case - * the caller has read kvm->online_vcpus before (as is the case - * for kvm_for_each_vcpu, for example). - */ + int num_vcpus = atomic_read(&kvm->online_vcpus); + i = array_index_nospec(i, num_vcpus); + + /* Pairs with smp_wmb() in kvm_vm_ioctl_create_vcpu. */ smp_rmb(); return kvm->vcpus[i]; } @@ -578,6 +579,7 @@ void kvm_put_kvm(struct kvm *kvm); static inline struct kvm_memslots *__kvm_memslots(struct kvm *kvm, int as_id) { + as_id = array_index_nospec(as_id, KVM_ADDRESS_SPACE_NUM); return srcu_dereference_check(kvm->memslots[as_id], &kvm->srcu, lockdep_is_held(&kvm->slots_lock) || !refcount_read(&kvm->users_count)); |