4.9-stable patches

added patches:
	arm64-debug-don-t-propagate-unknown-far-into-si_code-for-debug-signals.patch
	arm64-debug-ensure-debug-handlers-check-triggering-exception-level.patch

diff --git a/queue-4.9/arm64-debug-don-t-propagate-unknown-far-into-si_code-for-debug-signals.patch b/queue-4.9/arm64-debug-don-t-propagate-unknown-far-into-si_code-for-debug-signals.patch
new file mode 100644 (file)
index 0000000..496036c
--- /dev/null
+++ b/queue-4.9/arm64-debug-don-t-propagate-unknown-far-into-si_code-for-debug-signals.patch
@@ -0,0 +1,68 @@
+From b9a4b9d084d978f80eb9210727c81804588b42ff Mon Sep 17 00:00:00 2001
+From: Will Deacon <will.deacon@arm.com>
+Date: Fri, 1 Mar 2019 13:28:00 +0000
+Subject: arm64: debug: Don't propagate UNKNOWN FAR into si_code for debug signals
+
+From: Will Deacon <will.deacon@arm.com>
+
+commit b9a4b9d084d978f80eb9210727c81804588b42ff upstream.
+
+FAR_EL1 is UNKNOWN for all debug exceptions other than those caused by
+taking a hardware watchpoint. Unfortunately, if a debug handler returns
+a non-zero value, then we will propagate the UNKNOWN FAR value to
+userspace via the si_addr field of the SIGTRAP siginfo_t.
+
+Instead, let's set si_addr to take on the PC of the faulting instruction,
+which we have available in the current pt_regs.
+
+Cc: <stable@vger.kernel.org>
+Reviewed-by: Mark Rutland <mark.rutland@arm.com>
+Signed-off-by: Will Deacon <will.deacon@arm.com>
+Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+
+---
+ arch/arm64/mm/fault.c |   11 ++++++-----
+ 1 file changed, 6 insertions(+), 5 deletions(-)
+
+--- a/arch/arm64/mm/fault.c
++++ b/arch/arm64/mm/fault.c
+@@ -673,11 +673,12 @@ void __init hook_debug_fault_code(int nr
+       debug_fault_info[nr].name       = name;
+ }
+ 
+-asmlinkage int __exception do_debug_exception(unsigned long addr,
++asmlinkage int __exception do_debug_exception(unsigned long addr_if_watchpoint,
+                                             unsigned int esr,
+                                             struct pt_regs *regs)
+ {
+       const struct fault_info *inf = debug_fault_info + DBG_ESR_EVT(esr);
++      unsigned long pc = instruction_pointer(regs);
+       struct siginfo info;
+       int rv;
+ 
+@@ -688,19 +689,19 @@ asmlinkage int __exception do_debug_exce
+       if (interrupts_enabled(regs))
+               trace_hardirqs_off();
+ 
+-      if (user_mode(regs) && instruction_pointer(regs) > TASK_SIZE)
++      if (user_mode(regs) && pc > TASK_SIZE)
+               arm64_apply_bp_hardening();
+ 
+-      if (!inf->fn(addr, esr, regs)) {
++      if (!inf->fn(addr_if_watchpoint, esr, regs)) {
+               rv = 1;
+       } else {
+               pr_alert("Unhandled debug exception: %s (0x%08x) at 0x%016lx\n",
+-                       inf->name, esr, addr);
++                       inf->name, esr, pc);
+ 
+               info.si_signo = inf->sig;
+               info.si_errno = 0;
+               info.si_code  = inf->code;
+-              info.si_addr  = (void __user *)addr;
++              info.si_addr  = (void __user *)pc;
+               arm64_notify_die("", regs, &info, 0);
+               rv = 0;
+       }

diff --git a/queue-4.9/arm64-debug-ensure-debug-handlers-check-triggering-exception-level.patch b/queue-4.9/arm64-debug-ensure-debug-handlers-check-triggering-exception-level.patch
new file mode 100644 (file)
index 0000000..dc9bfff
--- /dev/null
+++ b/queue-4.9/arm64-debug-ensure-debug-handlers-check-triggering-exception-level.patch
@@ -0,0 +1,93 @@
+From 6bd288569b50bc89fa5513031086746968f585cb Mon Sep 17 00:00:00 2001
+From: Will Deacon <will.deacon@arm.com>
+Date: Fri, 1 Mar 2019 13:28:01 +0000
+Subject: arm64: debug: Ensure debug handlers check triggering exception level
+
+From: Will Deacon <will.deacon@arm.com>
+
+commit 6bd288569b50bc89fa5513031086746968f585cb upstream.
+
+Debug exception handlers may be called for exceptions generated both by
+user and kernel code. In many cases, this is checked explicitly, but
+in other cases things either happen to work by happy accident or they
+go slightly wrong. For example, executing 'brk #4' from userspace will
+enter the kprobes code and be ignored, but the instruction will be
+retried forever in userspace instead of delivering a SIGTRAP.
+
+Fix this issue in the most stable-friendly fashion by simply adding
+explicit checks of the triggering exception level to all of our debug
+exception handlers.
+
+Cc: <stable@vger.kernel.org>
+Reviewed-by: Mark Rutland <mark.rutland@arm.com>
+Signed-off-by: Will Deacon <will.deacon@arm.com>
+Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+
+---
+ arch/arm64/kernel/kgdb.c           |   15 ++++++++++++---
+ arch/arm64/kernel/probes/kprobes.c |    6 ++++++
+ 2 files changed, 18 insertions(+), 3 deletions(-)
+
+--- a/arch/arm64/kernel/kgdb.c
++++ b/arch/arm64/kernel/kgdb.c
+@@ -231,24 +231,33 @@ int kgdb_arch_handle_exception(int excep
+ 
+ static int kgdb_brk_fn(struct pt_regs *regs, unsigned int esr)
+ {
++      if (user_mode(regs))
++              return DBG_HOOK_ERROR;
++
+       kgdb_handle_exception(1, SIGTRAP, 0, regs);
+-      return 0;
++      return DBG_HOOK_HANDLED;
+ }
+ NOKPROBE_SYMBOL(kgdb_brk_fn)
+ 
+ static int kgdb_compiled_brk_fn(struct pt_regs *regs, unsigned int esr)
+ {
++      if (user_mode(regs))
++              return DBG_HOOK_ERROR;
++
+       compiled_break = 1;
+       kgdb_handle_exception(1, SIGTRAP, 0, regs);
+ 
+-      return 0;
++      return DBG_HOOK_HANDLED;
+ }
+ NOKPROBE_SYMBOL(kgdb_compiled_brk_fn);
+ 
+ static int kgdb_step_brk_fn(struct pt_regs *regs, unsigned int esr)
+ {
++      if (user_mode(regs))
++              return DBG_HOOK_ERROR;
++
+       kgdb_handle_exception(1, SIGTRAP, 0, regs);
+-      return 0;
++      return DBG_HOOK_HANDLED;
+ }
+ NOKPROBE_SYMBOL(kgdb_step_brk_fn);
+ 
+--- a/arch/arm64/kernel/probes/kprobes.c
++++ b/arch/arm64/kernel/probes/kprobes.c
+@@ -450,6 +450,9 @@ kprobe_single_step_handler(struct pt_reg
+       struct kprobe_ctlblk *kcb = get_kprobe_ctlblk();
+       int retval;
+ 
++      if (user_mode(regs))
++              return DBG_HOOK_ERROR;
++
+       /* return error if this is not our step */
+       retval = kprobe_ss_hit(kcb, instruction_pointer(regs));
+ 
+@@ -466,6 +469,9 @@ kprobe_single_step_handler(struct pt_reg
+ int __kprobes
+ kprobe_breakpoint_handler(struct pt_regs *regs, unsigned int esr)
+ {
++      if (user_mode(regs))
++              return DBG_HOOK_ERROR;
++
+       kprobe_handler(regs);
+       return DBG_HOOK_HANDLED;
+ }