4.4-stable patches

added patches:
	x86-boot-compressed-disable-relocation-relaxation.patch
	xen-blkback-set-ring-xenblkd-to-null-after-kthread_stop.patch

diff --git a/queue-4.4/series b/queue-4.4/series
index 1725c86392b6b2f3f6972a9e5728baee5b5920ca..9657bdc305ef57a9fa9e1938591bd877ad3caab3 100644 (file)
--- a/queue-4.4/series
+++ b/queue-4.4/series
@@ -20,3 +20,5 @@ ipv6-create-multicast-route-with-rtprot_kernel.patch
 net_sched-avoid-shift-out-of-bounds-in-tcindex_set_parms.patch
 revert-mm-slub-fix-a-memory-leak-in-sysfs_slab_add.patch
 tracing-fix-race-in-trace_open-and-buffer-resize-call.patch
+xen-blkback-set-ring-xenblkd-to-null-after-kthread_stop.patch
+x86-boot-compressed-disable-relocation-relaxation.patch

diff --git a/queue-4.4/x86-boot-compressed-disable-relocation-relaxation.patch b/queue-4.4/x86-boot-compressed-disable-relocation-relaxation.patch
new file mode 100644 (file)
index 0000000..f4b86ee
--- /dev/null
+++ b/queue-4.4/x86-boot-compressed-disable-relocation-relaxation.patch
@@ -0,0 +1,90 @@
+From foo@baz Fri Jan 29 11:33:44 AM CET 2021
+From: Arvind Sankar <nivedita@alum.mit.edu>
+Date: Tue, 11 Aug 2020 20:43:08 -0400
+Subject: x86/boot/compressed: Disable relocation relaxation
+
+From: Arvind Sankar <nivedita@alum.mit.edu>
+
+commit 09e43968db40c33a73e9ddbfd937f46d5c334924 upstream.
+
+The x86-64 psABI [0] specifies special relocation types
+(R_X86_64_[REX_]GOTPCRELX) for indirection through the Global Offset
+Table, semantically equivalent to R_X86_64_GOTPCREL, which the linker
+can take advantage of for optimization (relaxation) at link time. This
+is supported by LLD and binutils versions 2.26 onwards.
+
+The compressed kernel is position-independent code, however, when using
+LLD or binutils versions before 2.27, it must be linked without the -pie
+option. In this case, the linker may optimize certain instructions into
+a non-position-independent form, by converting foo@GOTPCREL(%rip) to $foo.
+
+This potential issue has been present with LLD and binutils-2.26 for a
+long time, but it has never manifested itself before now:
+
+- LLD and binutils-2.26 only relax
+       movq    foo@GOTPCREL(%rip), %reg
+  to
+       leaq    foo(%rip), %reg
+  which is still position-independent, rather than
+       mov     $foo, %reg
+  which is permitted by the psABI when -pie is not enabled.
+
+- GCC happens to only generate GOTPCREL relocations on mov instructions.
+
+- CLang does generate GOTPCREL relocations on non-mov instructions, but
+  when building the compressed kernel, it uses its integrated assembler
+  (due to the redefinition of KBUILD_CFLAGS dropping -no-integrated-as),
+  which has so far defaulted to not generating the GOTPCRELX
+  relocations.
+
+Nick Desaulniers reports [1,2]:
+
+  "A recent change [3] to a default value of configuration variable
+   (ENABLE_X86_RELAX_RELOCATIONS OFF -> ON) in LLVM now causes Clang's
+   integrated assembler to emit R_X86_64_GOTPCRELX/R_X86_64_REX_GOTPCRELX
+   relocations. LLD will relax instructions with these relocations based
+   on whether the image is being linked as position independent or not.
+   When not, then LLD will relax these instructions to use absolute
+   addressing mode (R_RELAX_GOT_PC_NOPIC). This causes kernels built with
+   Clang and linked with LLD to fail to boot."
+
+Patch series [4] is a solution to allow the compressed kernel to be
+linked with -pie unconditionally, but even if merged is unlikely to be
+backported. As a simple solution that can be applied to stable as well,
+prevent the assembler from generating the relaxed relocation types using
+the -mrelax-relocations=no option. For ease of backporting, do this
+unconditionally.
+
+[0] https://gitlab.com/x86-psABIs/x86-64-ABI/-/blob/master/x86-64-ABI/linker-optimization.tex#L65
+[1] https://lore.kernel.org/lkml/20200807194100.3570838-1-ndesaulniers@google.com/
+[2] https://github.com/ClangBuiltLinux/linux/issues/1121
+[3] https://reviews.llvm.org/rGc41a18cf61790fc898dcda1055c3efbf442c14c0
+[4] https://lore.kernel.org/lkml/20200731202738.2577854-1-nivedita@alum.mit.edu/
+
+Reported-by: Nick Desaulniers <ndesaulniers@google.com>
+Signed-off-by: Arvind Sankar <nivedita@alum.mit.edu>
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Tested-by: Nick Desaulniers <ndesaulniers@google.com>
+Tested-by: Sedat Dilek <sedat.dilek@gmail.com>
+Acked-by: Ard Biesheuvel <ardb@kernel.org>
+Reviewed-by: Nick Desaulniers <ndesaulniers@google.com>
+Cc: stable@vger.kernel.org
+Link: https://lore.kernel.org/r/20200812004308.1448603-1-nivedita@alum.mit.edu
+[nc: Backport to 4.4]
+Signed-off-by: Nathan Chancellor <nathan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/x86/boot/compressed/Makefile |    2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/arch/x86/boot/compressed/Makefile
++++ b/arch/x86/boot/compressed/Makefile
+@@ -31,6 +31,8 @@ KBUILD_CFLAGS += -mno-mmx -mno-sse
+ KBUILD_CFLAGS += $(call cc-option,-ffreestanding)
+ KBUILD_CFLAGS += $(call cc-option,-fno-stack-protector)
+ KBUILD_CFLAGS += $(call cc-disable-warning, address-of-packed-member)
++# Disable relocation relaxation in case the link is not PIE.
++KBUILD_CFLAGS += $(call as-option,-Wa$(comma)-mrelax-relocations=no)
+ 
+ KBUILD_AFLAGS  := $(KBUILD_CFLAGS) -D__ASSEMBLY__
+ GCOV_PROFILE := n

diff --git a/queue-4.4/xen-blkback-set-ring-xenblkd-to-null-after-kthread_stop.patch b/queue-4.4/xen-blkback-set-ring-xenblkd-to-null-after-kthread_stop.patch
new file mode 100644 (file)
index 0000000..82f9034
--- /dev/null
+++ b/queue-4.4/xen-blkback-set-ring-xenblkd-to-null-after-kthread_stop.patch
@@ -0,0 +1,54 @@
+From 1c728719a4da6e654afb9cc047164755072ed7c9 Mon Sep 17 00:00:00 2001
+From: Pawel Wieczorkiewicz <wipawel@amazon.de>
+Date: Mon, 14 Dec 2020 10:25:57 +0100
+Subject: xen-blkback: set ring->xenblkd to NULL after kthread_stop()
+
+From: Pawel Wieczorkiewicz <wipawel@amazon.de>
+
+commit 1c728719a4da6e654afb9cc047164755072ed7c9 upstream.
+
+When xen_blkif_disconnect() is called, the kernel thread behind the
+block interface is stopped by calling kthread_stop(ring->xenblkd).
+The ring->xenblkd thread pointer being non-NULL determines if the
+thread has been already stopped.
+Normally, the thread's function xen_blkif_schedule() sets the
+ring->xenblkd to NULL, when the thread's main loop ends.
+
+However, when the thread has not been started yet (i.e.
+wake_up_process() has not been called on it), the xen_blkif_schedule()
+function would not be called yet.
+
+In such case the kthread_stop() call returns -EINTR and the
+ring->xenblkd remains dangling.
+When this happens, any consecutive call to xen_blkif_disconnect (for
+example in frontend_changed() callback) leads to a kernel crash in
+kthread_stop() (e.g. NULL pointer dereference in exit_creds()).
+
+This is XSA-350.
+
+Cc: <stable@vger.kernel.org> # 4.12
+Fixes: a24fa22ce22a ("xen/blkback: don't use xen_blkif_get() in xen-blkback kthread")
+Reported-by: Olivier Benjamin <oliben@amazon.com>
+Reported-by: Pawel Wieczorkiewicz <wipawel@amazon.de>
+Signed-off-by: Pawel Wieczorkiewicz <wipawel@amazon.de>
+Reviewed-by: Julien Grall <jgrall@amazon.com>
+Reviewed-by: Juergen Gross <jgross@suse.com>
+Signed-off-by: Juergen Gross <jgross@suse.com>
+[iwamatsu: change from ring to blkif]
+Signed-off-by: Nobuhiro Iwamatsu <nobuhiro1.iwamatsu@toshiba.co.jp>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/block/xen-blkback/xenbus.c |    1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/block/xen-blkback/xenbus.c
++++ b/drivers/block/xen-blkback/xenbus.c
+@@ -219,6 +219,7 @@ static int xen_blkif_disconnect(struct x
+ 
+       if (blkif->xenblkd) {
+               kthread_stop(blkif->xenblkd);
++              blkif->xenblkd = NULL;
+               wake_up(&blkif->shutdown_wq);
+       }
+