[PATCH] KVM: s390: Fix potential spectre warnings

[PATCH] KVM: s390: Fix potential spectre warnings

[Eric Farman]

Fix some warnings from smatch:

arch/s390/kvm/interrupt.c:2310 get_io_adapter() warn: potential spectre issue 'kvm->arch.adapters' [r] (local cap)
arch/s390/kvm/interrupt.c:2341 register_io_adapter() warn: potential spectre issue 'dev->kvm->arch.adapters' [w]

Signed-off-by: Eric Farman <farman@linux.ibm.com>
---
A recent patch from Paolo [1] acted as a reminder (thanks, Christian!)
that I had one for the s390 KVM code after some code reviews [2].
Let's clean that up.

[1] https://patchwork.kernel.org/patch/10895463/
[2] https://patchwork.kernel.org/patch/10788565/#22484223
---
 arch/s390/kvm/interrupt.c | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/arch/s390/kvm/interrupt.c b/arch/s390/kvm/interrupt.c
index 82162867f378..bfd55ad34a3e 100644
--- a/arch/s390/kvm/interrupt.c
+++ b/arch/s390/kvm/interrupt.c
@@ -14,6 +14,7 @@
 #include <linux/kvm_host.h>
 #include <linux/hrtimer.h>
 #include <linux/mmu_context.h>
+#include <linux/nospec.h>
 #include <linux/signal.h>
 #include <linux/slab.h>
 #include <linux/bitmap.h>
@@ -2307,6 +2308,7 @@ static struct s390_io_adapter *get_io_adapter(struct kvm *kvm, unsigned int id)
 {
 	if (id >= MAX_S390_IO_ADAPTERS)
 		return NULL;
+	id = array_index_nospec(id, MAX_S390_IO_ADAPTERS);
 	return kvm->arch.adapters[id];
 }
 
@@ -2320,8 +2322,13 @@ static int register_io_adapter(struct kvm_device *dev,
 			   (void __user *)attr->addr, sizeof(adapter_info)))
 		return -EFAULT;
 
-	if ((adapter_info.id >= MAX_S390_IO_ADAPTERS) ||
-	    (dev->kvm->arch.adapters[adapter_info.id] != NULL))
+	if (adapter_info.id >= MAX_S390_IO_ADAPTERS)
+		return -EINVAL;
+
+	adapter_info.id = array_index_nospec(adapter_info.id,
+					     MAX_S390_IO_ADAPTERS);
+
+	if (dev->kvm->arch.adapters[adapter_info.id] != NULL)
 		return -EINVAL;
 
 	adapter = kzalloc(sizeof(*adapter), GFP_KERNEL);
-- 
2.16.4

Re: [PATCH] KVM: s390: Fix potential spectre warnings

[David Hildenbrand]

On 17.04.19 02:54, Eric Farman wrote:
> Fix some warnings from smatch:
> 
> arch/s390/kvm/interrupt.c:2310 get_io_adapter() warn: potential spectre issue 'kvm->arch.adapters' [r] (local cap)
> arch/s390/kvm/interrupt.c:2341 register_io_adapter() warn: potential spectre issue 'dev->kvm->arch.adapters' [w]
> 
> Signed-off-by: Eric Farman <farman@linux.ibm.com>
> ---
> A recent patch from Paolo [1] acted as a reminder (thanks, Christian!)
> that I had one for the s390 KVM code after some code reviews [2].
> Let's clean that up.
> 
> [1] https://patchwork.kernel.org/patch/10895463/
> [2] https://patchwork.kernel.org/patch/10788565/#22484223
> ---
>  arch/s390/kvm/interrupt.c | 11 +++++++++--
>  1 file changed, 9 insertions(+), 2 deletions(-)
> 
> diff --git a/arch/s390/kvm/interrupt.c b/arch/s390/kvm/interrupt.c
> index 82162867f378..bfd55ad34a3e 100644
> --- a/arch/s390/kvm/interrupt.c
> +++ b/arch/s390/kvm/interrupt.c
> @@ -14,6 +14,7 @@
>  #include <linux/kvm_host.h>
>  #include <linux/hrtimer.h>
>  #include <linux/mmu_context.h>
> +#include <linux/nospec.h>
>  #include <linux/signal.h>
>  #include <linux/slab.h>
>  #include <linux/bitmap.h>
> @@ -2307,6 +2308,7 @@ static struct s390_io_adapter *get_io_adapter(struct kvm *kvm, unsigned int id)
>  {
>  	if (id >= MAX_S390_IO_ADAPTERS)
>  		return NULL;
> +	id = array_index_nospec(id, MAX_S390_IO_ADAPTERS);
>  	return kvm->arch.adapters[id];

return kvm->arch.adapters[array_index_nospec(id, MAX_S390_IO_ADAPTERS)];

should exactly fit into a single line if I am not wrong.

>  }
>  
> @@ -2320,8 +2322,13 @@ static int register_io_adapter(struct kvm_device *dev,
>  			   (void __user *)attr->addr, sizeof(adapter_info)))
>  		return -EFAULT;
>  
> -	if ((adapter_info.id >= MAX_S390_IO_ADAPTERS) ||
> -	    (dev->kvm->arch.adapters[adapter_info.id] != NULL))
> +	if (adapter_info.id >= MAX_S390_IO_ADAPTERS)
> +		return -EINVAL;
> +
> +	adapter_info.id = array_index_nospec(adapter_info.id,
> +					     MAX_S390_IO_ADAPTERS);

I dislike that we are modifying adapter_info here. Can you use a local
variable instead?

> +
> +	if (dev->kvm->arch.adapters[adapter_info.id] != NULL)
>  		return -EINVAL;
>  
>  	adapter = kzalloc(sizeof(*adapter), GFP_KERNEL);
> 

-- 

Thanks,

David / dhildenb

Re: [PATCH] KVM: s390: Fix potential spectre warnings

[Paolo Bonzini]

On 17/04/19 02:54, Eric Farman wrote:
> Fix some warnings from smatch:
> 
> arch/s390/kvm/interrupt.c:2310 get_io_adapter() warn: potential spectre issue 'kvm->arch.adapters' [r] (local cap)
> arch/s390/kvm/interrupt.c:2341 register_io_adapter() warn: potential spectre issue 'dev->kvm->arch.adapters' [w]
> 
> Signed-off-by: Eric Farman <farman@linux.ibm.com>
> ---
> A recent patch from Paolo [1] acted as a reminder (thanks, Christian!)
> that I had one for the s390 KVM code after some code reviews [2].
> Let's clean that up.

Spectrev1 is a gift that keeps on giving... I suppose Christian will
queue this one and I don't have anything to do here.

Paolo

Re: [PATCH] KVM: s390: Fix potential spectre warnings

[Christian Borntraeger]

On 17.04.19 15:09, Paolo Bonzini wrote:
> On 17/04/19 02:54, Eric Farman wrote:
>> Fix some warnings from smatch:
>>
>> arch/s390/kvm/interrupt.c:2310 get_io_adapter() warn: potential spectre issue 'kvm->arch.adapters' [r] (local cap)
>> arch/s390/kvm/interrupt.c:2341 register_io_adapter() warn: potential spectre issue 'dev->kvm->arch.adapters' [w]
>>
>> Signed-off-by: Eric Farman <farman@linux.ibm.com>
>> ---
>> A recent patch from Paolo [1] acted as a reminder (thanks, Christian!)
>> that I had one for the s390 KVM code after some code reviews [2].
>> Let's clean that up.
> 
> Spectrev1 is a gift that keeps on giving... I suppose Christian will
> queue this one and I don't have anything to do here.

Yes, will just wait until the review has settled.

Re: [PATCH] KVM: s390: Fix potential spectre warnings

[Paolo Bonzini]

On 17/04/19 09:49, David Hildenbrand wrote:
> return kvm->arch.adapters[array_index_nospec(id, MAX_S390_IO_ADAPTERS)];
> 
> should exactly fit into a single line if I am not wrong.

git grep "\\[.*array_index_nospec" suggests that the preferred idiom is

	var = array_index_nospec(var, SIZE)

which makes sense since it sanitizes var once and for all.

Paolo

Re: [PATCH] KVM: s390: Fix potential spectre warnings

[Eric Farman]

On 4/17/19 3:49 AM, David Hildenbrand wrote:
> On 17.04.19 02:54, Eric Farman wrote:
>> Fix some warnings from smatch:
>>
>> arch/s390/kvm/interrupt.c:2310 get_io_adapter() warn: potential spectre issue 'kvm->arch.adapters' [r] (local cap)
>> arch/s390/kvm/interrupt.c:2341 register_io_adapter() warn: potential spectre issue 'dev->kvm->arch.adapters' [w]
>>
>> Signed-off-by: Eric Farman <farman@linux.ibm.com>
>> ---
>> A recent patch from Paolo [1] acted as a reminder (thanks, Christian!)
>> that I had one for the s390 KVM code after some code reviews [2].
>> Let's clean that up.
>>
>> [1] https://patchwork.kernel.org/patch/10895463/
>> [2] https://patchwork.kernel.org/patch/10788565/#22484223
>> ---
>>   arch/s390/kvm/interrupt.c | 11 +++++++++--
>>   1 file changed, 9 insertions(+), 2 deletions(-)
>>
>> diff --git a/arch/s390/kvm/interrupt.c b/arch/s390/kvm/interrupt.c
>> index 82162867f378..bfd55ad34a3e 100644
>> --- a/arch/s390/kvm/interrupt.c
>> +++ b/arch/s390/kvm/interrupt.c
>> @@ -14,6 +14,7 @@
>>   #include <linux/kvm_host.h>
>>   #include <linux/hrtimer.h>
>>   #include <linux/mmu_context.h>
>> +#include <linux/nospec.h>
>>   #include <linux/signal.h>
>>   #include <linux/slab.h>
>>   #include <linux/bitmap.h>
>> @@ -2307,6 +2308,7 @@ static struct s390_io_adapter *get_io_adapter(struct kvm *kvm, unsigned int id)
>>   {
>>   	if (id >= MAX_S390_IO_ADAPTERS)
>>   		return NULL;
>> +	id = array_index_nospec(id, MAX_S390_IO_ADAPTERS);
>>   	return kvm->arch.adapters[id];
> 
> return kvm->arch.adapters[array_index_nospec(id, MAX_S390_IO_ADAPTERS)];
> 
> should exactly fit into a single line if I am not wrong.

Yeah, just.  As Paolo pointed out, that's not common usage.  Though of 
the four other hits I see, only one of them is the same as this 
instance, in that "id" is passed as a variable and then we immediately 
return with an array entry (even if NULL) rather than doing something 
else in that function.  So maybe all-in-one-line here is a little cleaner.

> 
>>   }
>>   
>> @@ -2320,8 +2322,13 @@ static int register_io_adapter(struct kvm_device *dev,
>>   			   (void __user *)attr->addr, sizeof(adapter_info)))
>>   		return -EFAULT;
>>   
>> -	if ((adapter_info.id >= MAX_S390_IO_ADAPTERS) ||
>> -	    (dev->kvm->arch.adapters[adapter_info.id] != NULL))
>> +	if (adapter_info.id >= MAX_S390_IO_ADAPTERS)
>> +		return -EINVAL;
>> +
>> +	adapter_info.id = array_index_nospec(adapter_info.id,
>> +					     MAX_S390_IO_ADAPTERS);
> 
> I dislike that we are modifying adapter_info here. Can you use a local
> variable instead?

I guess, but adapter_info is a local variable too.  So sanitization this 
way seems fine to me.  But if you dislike it more than I don't care, 
I'll add another local variable.  :)

> 
>> +
>> +	if (dev->kvm->arch.adapters[adapter_info.id] != NULL)
>>   		return -EINVAL;
>>   
>>   	adapter = kzalloc(sizeof(*adapter), GFP_KERNEL);
>>
> 

Re: [PATCH] KVM: s390: Fix potential spectre warnings

[David Hildenbrand]

On 17.04.19 16:23, Eric Farman wrote:
> 
> 
> On 4/17/19 3:49 AM, David Hildenbrand wrote:
>> On 17.04.19 02:54, Eric Farman wrote:
>>> Fix some warnings from smatch:
>>>
>>> arch/s390/kvm/interrupt.c:2310 get_io_adapter() warn: potential spectre issue 'kvm->arch.adapters' [r] (local cap)
>>> arch/s390/kvm/interrupt.c:2341 register_io_adapter() warn: potential spectre issue 'dev->kvm->arch.adapters' [w]
>>>
>>> Signed-off-by: Eric Farman <farman@linux.ibm.com>
>>> ---
>>> A recent patch from Paolo [1] acted as a reminder (thanks, Christian!)
>>> that I had one for the s390 KVM code after some code reviews [2].
>>> Let's clean that up.
>>>
>>> [1] https://patchwork.kernel.org/patch/10895463/
>>> [2] https://patchwork.kernel.org/patch/10788565/#22484223
>>> ---
>>>   arch/s390/kvm/interrupt.c | 11 +++++++++--
>>>   1 file changed, 9 insertions(+), 2 deletions(-)
>>>
>>> diff --git a/arch/s390/kvm/interrupt.c b/arch/s390/kvm/interrupt.c
>>> index 82162867f378..bfd55ad34a3e 100644
>>> --- a/arch/s390/kvm/interrupt.c
>>> +++ b/arch/s390/kvm/interrupt.c
>>> @@ -14,6 +14,7 @@
>>>   #include <linux/kvm_host.h>
>>>   #include <linux/hrtimer.h>
>>>   #include <linux/mmu_context.h>
>>> +#include <linux/nospec.h>
>>>   #include <linux/signal.h>
>>>   #include <linux/slab.h>
>>>   #include <linux/bitmap.h>
>>> @@ -2307,6 +2308,7 @@ static struct s390_io_adapter *get_io_adapter(struct kvm *kvm, unsigned int id)
>>>   {
>>>   	if (id >= MAX_S390_IO_ADAPTERS)
>>>   		return NULL;
>>> +	id = array_index_nospec(id, MAX_S390_IO_ADAPTERS);
>>>   	return kvm->arch.adapters[id];
>>
>> return kvm->arch.adapters[array_index_nospec(id, MAX_S390_IO_ADAPTERS)];
>>
>> should exactly fit into a single line if I am not wrong.
> 
> Yeah, just.  As Paolo pointed out, that's not common usage.  Though of 
> the four other hits I see, only one of them is the same as this 
> instance, in that "id" is passed as a variable and then we immediately 
> return with an array entry (even if NULL) rather than doing something 
> else in that function.  So maybe all-in-one-line here is a little cleaner.
> 
>>
>>>   }
>>>   
>>> @@ -2320,8 +2322,13 @@ static int register_io_adapter(struct kvm_device *dev,
>>>   			   (void __user *)attr->addr, sizeof(adapter_info)))
>>>   		return -EFAULT;
>>>   
>>> -	if ((adapter_info.id >= MAX_S390_IO_ADAPTERS) ||
>>> -	    (dev->kvm->arch.adapters[adapter_info.id] != NULL))
>>> +	if (adapter_info.id >= MAX_S390_IO_ADAPTERS)
>>> +		return -EINVAL;
>>> +
>>> +	adapter_info.id = array_index_nospec(adapter_info.id,
>>> +					     MAX_S390_IO_ADAPTERS);
>>
>> I dislike that we are modifying adapter_info here. Can you use a local
>> variable instead?
> 
> I guess, but adapter_info is a local variable too.  So sanitization this 
> way seems fine to me.  But if you dislike it more than I don't care, 
> I'll add another local variable.  :)


Oh right, I was confused, sorry. All fine.

Reviewed-by: David Hildenbrand <david@redhat.com>

-- 

Thanks,

David / dhildenb

Re: [PATCH] KVM: s390: Fix potential spectre warnings

[Christian Borntraeger]

On 17.04.19 02:54, Eric Farman wrote:
> Fix some warnings from smatch:
> 
> arch/s390/kvm/interrupt.c:2310 get_io_adapter() warn: potential spectre issue 'kvm->arch.adapters' [r] (local cap)
> arch/s390/kvm/interrupt.c:2341 register_io_adapter() warn: potential spectre issue 'dev->kvm->arch.adapters' [w]
> 
> Signed-off-by: Eric Farman <farman@linux.ibm.com>
> ---
> A recent patch from Paolo [1] acted as a reminder (thanks, Christian!)
> that I had one for the s390 KVM code after some code reviews [2].
> Let's clean that up.
> 
> [1] https://patchwork.kernel.org/patch/10895463/
> [2] https://patchwork.kernel.org/patch/10788565/#22484223

Thanks applied.

Re: [PATCH] KVM: s390: Fix potential spectre warnings

[Cornelia Huck]

On Wed, 17 Apr 2019 02:54:14 +0200
Eric Farman <farman@linux.ibm.com> wrote:

> Fix some warnings from smatch:
> 
> arch/s390/kvm/interrupt.c:2310 get_io_adapter() warn: potential spectre issue 'kvm->arch.adapters' [r] (local cap)
> arch/s390/kvm/interrupt.c:2341 register_io_adapter() warn: potential spectre issue 'dev->kvm->arch.adapters' [w]
> 
> Signed-off-by: Eric Farman <farman@linux.ibm.com>
> ---
> A recent patch from Paolo [1] acted as a reminder (thanks, Christian!)
> that I had one for the s390 KVM code after some code reviews [2].
> Let's clean that up.
> 
> [1] https://patchwork.kernel.org/patch/10895463/
> [2] https://patchwork.kernel.org/patch/10788565/#22484223
> ---
>  arch/s390/kvm/interrupt.c | 11 +++++++++--
>  1 file changed, 9 insertions(+), 2 deletions(-)

Reviewed-by: Cornelia Huck <cohuck@redhat.com>