5.10-stable patches

added patches:
	x86-boot-wrap-literal-addresses-in-absolute_pointer.patch

diff --git a/queue-5.10/series b/queue-5.10/series
index 89974780d4b9932f54f5f177192b7ee7d87e6ed4..d389e2c3c06e1e41316724eaa27be1a5ccad145c 100644 (file)
--- a/queue-5.10/series
+++ b/queue-5.10/series
@@ -87,3 +87,4 @@ misc-fastrpc-return-epipe-to-invocations-on-device-removal.patch
 misc-fastrpc-reject-new-invocations-during-device-removal.patch
 scsi-stex-fix-gcc-13-warnings.patch
 ata-libata-scsi-use-correct-device-no-in-ata_find_dev.patch
+x86-boot-wrap-literal-addresses-in-absolute_pointer.patch

diff --git a/queue-5.10/x86-boot-wrap-literal-addresses-in-absolute_pointer.patch b/queue-5.10/x86-boot-wrap-literal-addresses-in-absolute_pointer.patch
new file mode 100644 (file)
index 0000000..d2d3b40
--- /dev/null
+++ b/queue-5.10/x86-boot-wrap-literal-addresses-in-absolute_pointer.patch
@@ -0,0 +1,141 @@
+From aeb84412037b89e06f45e382f044da6f200e12f8 Mon Sep 17 00:00:00 2001
+From: Kees Cook <keescook@chromium.org>
+Date: Sun, 27 Feb 2022 11:59:18 -0800
+Subject: x86/boot: Wrap literal addresses in absolute_pointer()
+
+From: Kees Cook <keescook@chromium.org>
+
+commit aeb84412037b89e06f45e382f044da6f200e12f8 upstream.
+
+GCC 11 (incorrectly[1]) assumes that literal values cast to (void *)
+should be treated like a NULL pointer with an offset, and raises
+diagnostics when doing bounds checking under -Warray-bounds. GCC 12
+got "smarter" about finding these:
+
+  In function 'rdfs8',
+      inlined from 'vga_recalc_vertical' at /srv/code/arch/x86/boot/video-mode.c:124:29,
+      inlined from 'set_mode' at /srv/code/arch/x86/boot/video-mode.c:163:3:
+  /srv/code/arch/x86/boot/boot.h:114:9: warning: array subscript 0 is outside array bounds of 'u8[0]' {aka 'unsigned char[]'} [-Warray-bounds]
+    114 |         asm volatile("movb %%fs:%1,%0" : "=q" (v) : "m" (*(u8 *)addr));
+        |         ^~~
+
+This has been solved in other places[2] already by using the recently
+added absolute_pointer() macro. Do the same here.
+
+  [1] https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99578
+  [2] https://lore.kernel.org/all/20210912160149.2227137-1-linux@roeck-us.net/
+
+Signed-off-by: Kees Cook <keescook@chromium.org>
+Signed-off-by: Borislav Petkov <bp@suse.de>
+Reviewed-by: Guenter Roeck <linux@roeck-us.net>
+Link: https://lore.kernel.org/r/20220227195918.705219-1-keescook@chromium.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/x86/boot/boot.h |   36 ++++++++++++++++++++++++------------
+ arch/x86/boot/main.c |    2 +-
+ 2 files changed, 25 insertions(+), 13 deletions(-)
+
+--- a/arch/x86/boot/boot.h
++++ b/arch/x86/boot/boot.h
+@@ -110,66 +110,78 @@ typedef unsigned int addr_t;
+ 
+ static inline u8 rdfs8(addr_t addr)
+ {
++      u8 *ptr = (u8 *)absolute_pointer(addr);
+       u8 v;
+-      asm volatile("movb %%fs:%1,%0" : "=q" (v) : "m" (*(u8 *)addr));
++      asm volatile("movb %%fs:%1,%0" : "=q" (v) : "m" (*ptr));
+       return v;
+ }
+ static inline u16 rdfs16(addr_t addr)
+ {
++      u16 *ptr = (u16 *)absolute_pointer(addr);
+       u16 v;
+-      asm volatile("movw %%fs:%1,%0" : "=r" (v) : "m" (*(u16 *)addr));
++      asm volatile("movw %%fs:%1,%0" : "=r" (v) : "m" (*ptr));
+       return v;
+ }
+ static inline u32 rdfs32(addr_t addr)
+ {
++      u32 *ptr = (u32 *)absolute_pointer(addr);
+       u32 v;
+-      asm volatile("movl %%fs:%1,%0" : "=r" (v) : "m" (*(u32 *)addr));
++      asm volatile("movl %%fs:%1,%0" : "=r" (v) : "m" (*ptr));
+       return v;
+ }
+ 
+ static inline void wrfs8(u8 v, addr_t addr)
+ {
+-      asm volatile("movb %1,%%fs:%0" : "+m" (*(u8 *)addr) : "qi" (v));
++      u8 *ptr = (u8 *)absolute_pointer(addr);
++      asm volatile("movb %1,%%fs:%0" : "+m" (*ptr) : "qi" (v));
+ }
+ static inline void wrfs16(u16 v, addr_t addr)
+ {
+-      asm volatile("movw %1,%%fs:%0" : "+m" (*(u16 *)addr) : "ri" (v));
++      u16 *ptr = (u16 *)absolute_pointer(addr);
++      asm volatile("movw %1,%%fs:%0" : "+m" (*ptr) : "ri" (v));
+ }
+ static inline void wrfs32(u32 v, addr_t addr)
+ {
+-      asm volatile("movl %1,%%fs:%0" : "+m" (*(u32 *)addr) : "ri" (v));
++      u32 *ptr = (u32 *)absolute_pointer(addr);
++      asm volatile("movl %1,%%fs:%0" : "+m" (*ptr) : "ri" (v));
+ }
+ 
+ static inline u8 rdgs8(addr_t addr)
+ {
++      u8 *ptr = (u8 *)absolute_pointer(addr);
+       u8 v;
+-      asm volatile("movb %%gs:%1,%0" : "=q" (v) : "m" (*(u8 *)addr));
++      asm volatile("movb %%gs:%1,%0" : "=q" (v) : "m" (*ptr));
+       return v;
+ }
+ static inline u16 rdgs16(addr_t addr)
+ {
++      u16 *ptr = (u16 *)absolute_pointer(addr);
+       u16 v;
+-      asm volatile("movw %%gs:%1,%0" : "=r" (v) : "m" (*(u16 *)addr));
++      asm volatile("movw %%gs:%1,%0" : "=r" (v) : "m" (*ptr));
+       return v;
+ }
+ static inline u32 rdgs32(addr_t addr)
+ {
++      u32 *ptr = (u32 *)absolute_pointer(addr);
+       u32 v;
+-      asm volatile("movl %%gs:%1,%0" : "=r" (v) : "m" (*(u32 *)addr));
++      asm volatile("movl %%gs:%1,%0" : "=r" (v) : "m" (*ptr));
+       return v;
+ }
+ 
+ static inline void wrgs8(u8 v, addr_t addr)
+ {
+-      asm volatile("movb %1,%%gs:%0" : "+m" (*(u8 *)addr) : "qi" (v));
++      u8 *ptr = (u8 *)absolute_pointer(addr);
++      asm volatile("movb %1,%%gs:%0" : "+m" (*ptr) : "qi" (v));
+ }
+ static inline void wrgs16(u16 v, addr_t addr)
+ {
+-      asm volatile("movw %1,%%gs:%0" : "+m" (*(u16 *)addr) : "ri" (v));
++      u16 *ptr = (u16 *)absolute_pointer(addr);
++      asm volatile("movw %1,%%gs:%0" : "+m" (*ptr) : "ri" (v));
+ }
+ static inline void wrgs32(u32 v, addr_t addr)
+ {
+-      asm volatile("movl %1,%%gs:%0" : "+m" (*(u32 *)addr) : "ri" (v));
++      u32 *ptr = (u32 *)absolute_pointer(addr);
++      asm volatile("movl %1,%%gs:%0" : "+m" (*ptr) : "ri" (v));
+ }
+ 
+ /* Note: these only return true/false, not a signed return value! */
+--- a/arch/x86/boot/main.c
++++ b/arch/x86/boot/main.c
+@@ -33,7 +33,7 @@ static void copy_boot_params(void)
+               u16 cl_offset;
+       };
+       const struct old_cmdline * const oldcmd =
+-              (const struct old_cmdline *)OLD_CL_ADDRESS;
++              absolute_pointer(OLD_CL_ADDRESS);
+ 
+       BUILD_BUG_ON(sizeof(boot_params) != 4096);
+       memcpy(&boot_params.hdr, &hdr, sizeof(hdr));