tree f7926915eae9b4433cdbc091a81bd7ebb6d578a1
parent 1b0bb7e515b2292da2be1286b994ad1cf1096af3
author Jason Wang <jasowang@redhat.com> 1540879849 +0800
committer Greg Kroah-Hartman <gregkh@linuxfoundation.org> 1541864578 -0800

vhost: Fix Spectre V1 vulnerability

[ Upstream commit ff002269a4ee9c769dbf9365acef633ebcbd6cbe ]

The idx in vhost_vring_ioctl() was controlled by userspace, hence a
potential exploitation of the Spectre variant 1 vulnerability.

Fixing this by sanitizing idx before using it to index d->vqs.

Cc: Michael S. Tsirkin <mst@redhat.com>
Cc: Josh Poimboeuf <jpoimboe@redhat.com>
Cc: Andrea Arcangeli <aarcange@redhat.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>