>>> On 08.02.19 at 14:44, <nmant...@amazon.de> wrote: > @@ -3453,7 +3456,8 @@ int hvm_msr_read_intercept(unsigned int msr, uint64_t > *msr_content) > if ( (index / 2) >= > MASK_EXTR(v->arch.hvm.mtrr.mtrr_cap, MTRRcap_VCNT) ) > goto gp_fault; > - *msr_content = var_range_base[index]; > + *msr_content = var_range_base[array_index_nospec(index, > + 2*MASK_EXTR(v->arch.hvm.mtrr.mtrr_cap, > MTRRcap_VCNT))];
Missing blanks around *. This alone would be easy to adjust while committing, but there's still the only partially discussed question regarding ... > @@ -4104,6 +4108,12 @@ static int hvmop_set_param( > if ( a.index >= HVM_NR_PARAMS ) > return -EINVAL; > > + /* > + * Make sure the guest controlled value a.index is bounded even during > + * speculative execution. > + */ > + a.index = array_index_nospec(a.index, HVM_NR_PARAMS); > + > d = rcu_lock_domain_by_any_id(a.domid); > if ( d == NULL ) > return -ESRCH; > @@ -4370,6 +4380,12 @@ static int hvmop_get_param( > if ( a.index >= HVM_NR_PARAMS ) > return -EINVAL; > > + /* > + * Make sure the guest controlled value a.index is bounded even during > + * speculative execution. > + */ > + a.index = array_index_nospec(a.index, HVM_NR_PARAMS); ... the usefulness of these two. To make forward progress it may be worthwhile to split off these two changes into a separate patch. If you're fine with this, I could strip these two before committing, in which case the remaining change is Reviewed-by: Jan Beulich <jbeul...@suse.com> Jan _______________________________________________ Xen-devel mailing list Xen-devel@lists.xenproject.org https://lists.xenproject.org/mailman/listinfo/xen-devel
