From 249f9be58c7fd061e3323419c9adfeb938a2c48c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Carlos=20L=C3=B3pez?= Date: Tue, 9 Jun 2026 15:18:55 +0200 Subject: [PATCH] KVM: x86: Fix array_index_nospec() protection in kvm_vcpu_ioctl_x86_set_mce() MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Commit aebc3ca19063 ("KVM: x86: Enable CMCI capability by default and handle injected UCNA errors") introduced kvm_vcpu_x86_set_ucna(), which accesses @vcpu->arch.mci_ctl2_banks[] using @mce->bank as the index. The @mce struct is user-controlled, provided via the KVM_X86_SET_MCE ioctl. The caller of this function, kvm_vcpu_ioctl_x86_set_mce(), bounds-checks @mce->bank and applies array_index_nospec() to advance the @banks pointer, but @mce->bank itself is passed through unclamped. On a speculative path that bypasses the bounds check, the raw @mce->bank value can index mci_ctl2_banks[] out-of-bounds. In practice this is a very weak gadget, and would at most allow leaking a single bit in a 64-bit integer, but prevent potential future issues by clamping @mce->bank in place with array_index_nospec(), before passing the struct to kvm_vcpu_x86_set_ucna(). Fixes: aebc3ca19063 ("KVM: x86: Enable CMCI capability by default and handle injected UCNA errors") Signed-off-by: Carlos López Link: https://patch.msgid.link/20260609131856.2562222-3-clopez@suse.de Signed-off-by: Sean Christopherson --- arch/x86/kvm/x86.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c index 2982e3bc2821..d9cff1f8dff3 100644 --- a/arch/x86/kvm/x86.c +++ b/arch/x86/kvm/x86.c @@ -2876,7 +2876,8 @@ static int kvm_vcpu_ioctl_x86_set_mce(struct kvm_vcpu *vcpu, if (mce->bank >= bank_num || !(mce->status & MCI_STATUS_VAL)) return -EINVAL; - banks += array_index_nospec(4 * mce->bank, 4 * bank_num); + mce->bank = array_index_nospec(mce->bank, bank_num); + banks += 4 * mce->bank; if (is_ucna(mce)) return kvm_vcpu_x86_set_ucna(vcpu, mce, banks);