From: Greg Kroah-Hartman Date: Wed, 27 Nov 2019 10:26:20 +0000 (+0100) Subject: 4.9-stable patches X-Git-Tag: v4.4.204~46 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=1b3810da9d5a94faec28b19615acd208922be846;p=thirdparty%2Fkernel%2Fstable-queue.git 4.9-stable patches added patches: nfc-port100-handle-command-failure-cleanly.patch x86-speculation-fix-incorrect-mds-taa-mitigation-status.patch x86-speculation-fix-redundant-mds-mitigation-message.patch --- diff --git a/queue-4.9/nfc-port100-handle-command-failure-cleanly.patch b/queue-4.9/nfc-port100-handle-command-failure-cleanly.patch new file mode 100644 index 00000000000..a213a4fa7e4 --- /dev/null +++ b/queue-4.9/nfc-port100-handle-command-failure-cleanly.patch @@ -0,0 +1,34 @@ +From 5f9f0b11f0816b35867f2cf71e54d95f53f03902 Mon Sep 17 00:00:00 2001 +From: Oliver Neukum +Date: Thu, 21 Nov 2019 11:37:10 +0100 +Subject: nfc: port100: handle command failure cleanly + +From: Oliver Neukum + +commit 5f9f0b11f0816b35867f2cf71e54d95f53f03902 upstream. + +If starting the transfer of a command suceeds but the transfer for the reply +fails, it is not enough to initiate killing the transfer for the +command may still be running. You need to wait for the killing to finish +before you can reuse URB and buffer. + +Reported-and-tested-by: syzbot+711468aa5c3a1eabf863@syzkaller.appspotmail.com +Signed-off-by: Oliver Neukum +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/nfc/port100.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/nfc/port100.c ++++ b/drivers/nfc/port100.c +@@ -791,7 +791,7 @@ static int port100_send_frame_async(stru + + rc = port100_submit_urb_for_ack(dev, GFP_KERNEL); + if (rc) +- usb_unlink_urb(dev->out_urb); ++ usb_kill_urb(dev->out_urb); + + exit: + mutex_unlock(&dev->out_urb_lock); diff --git a/queue-4.9/series b/queue-4.9/series index f3955fb87b8..3d18983d2c7 100644 --- a/queue-4.9/series +++ b/queue-4.9/series @@ -117,3 +117,6 @@ ocfs2-remove-ocfs2_is_o2cb_active.patch arm-8904-1-skip-nomap-memblocks-while-finding-the-lowmem-highmem-boundary.patch arc-perf-accommodate-big-endian-cpu.patch x86-insn-fix-awk-regexp-warnings.patch +x86-speculation-fix-incorrect-mds-taa-mitigation-status.patch +x86-speculation-fix-redundant-mds-mitigation-message.patch +nfc-port100-handle-command-failure-cleanly.patch diff --git a/queue-4.9/x86-speculation-fix-incorrect-mds-taa-mitigation-status.patch b/queue-4.9/x86-speculation-fix-incorrect-mds-taa-mitigation-status.patch new file mode 100644 index 00000000000..5b3712391ef --- /dev/null +++ b/queue-4.9/x86-speculation-fix-incorrect-mds-taa-mitigation-status.patch @@ -0,0 +1,154 @@ +From 64870ed1b12e235cfca3f6c6da75b542c973ff78 Mon Sep 17 00:00:00 2001 +From: Waiman Long +Date: Fri, 15 Nov 2019 11:14:44 -0500 +Subject: x86/speculation: Fix incorrect MDS/TAA mitigation status + +From: Waiman Long + +commit 64870ed1b12e235cfca3f6c6da75b542c973ff78 upstream. + +For MDS vulnerable processors with TSX support, enabling either MDS or +TAA mitigations will enable the use of VERW to flush internal processor +buffers at the right code path. IOW, they are either both mitigated +or both not. However, if the command line options are inconsistent, +the vulnerabilites sysfs files may not report the mitigation status +correctly. + +For example, with only the "mds=off" option: + + vulnerabilities/mds:Vulnerable; SMT vulnerable + vulnerabilities/tsx_async_abort:Mitigation: Clear CPU buffers; SMT vulnerable + +The mds vulnerabilities file has wrong status in this case. Similarly, +the taa vulnerability file will be wrong with mds mitigation on, but +taa off. + +Change taa_select_mitigation() to sync up the two mitigation status +and have them turned off if both "mds=off" and "tsx_async_abort=off" +are present. + +Update documentation to emphasize the fact that both "mds=off" and +"tsx_async_abort=off" have to be specified together for processors that +are affected by both TAA and MDS to be effective. + + [ bp: Massage and add kernel-parameters.txt change too. ] + +Fixes: 1b42f017415b ("x86/speculation/taa: Add mitigation for TSX Async Abort") +Signed-off-by: Waiman Long +Signed-off-by: Borislav Petkov +Cc: Greg Kroah-Hartman +Cc: "H. Peter Anvin" +Cc: Ingo Molnar +Cc: Jiri Kosina +Cc: Jonathan Corbet +Cc: Josh Poimboeuf +Cc: linux-doc@vger.kernel.org +Cc: Mark Gross +Cc: +Cc: Pawan Gupta +Cc: Peter Zijlstra +Cc: Thomas Gleixner +Cc: Tim Chen +Cc: Tony Luck +Cc: Tyler Hicks +Cc: x86-ml +Link: https://lkml.kernel.org/r/20191115161445.30809-2-longman@redhat.com +Signed-off-by: Greg Kroah-Hartman + +--- + Documentation/hw-vuln/mds.rst | 7 +++++-- + Documentation/hw-vuln/tsx_async_abort.rst | 5 ++++- + Documentation/kernel-parameters.txt | 11 +++++++++++ + arch/x86/kernel/cpu/bugs.c | 17 +++++++++++++++-- + 4 files changed, 35 insertions(+), 5 deletions(-) + +--- a/Documentation/hw-vuln/mds.rst ++++ b/Documentation/hw-vuln/mds.rst +@@ -265,8 +265,11 @@ time with the option "mds=". The valid a + + ============ ============================================================= + +-Not specifying this option is equivalent to "mds=full". +- ++Not specifying this option is equivalent to "mds=full". For processors ++that are affected by both TAA (TSX Asynchronous Abort) and MDS, ++specifying just "mds=off" without an accompanying "tsx_async_abort=off" ++will have no effect as the same mitigation is used for both ++vulnerabilities. + + Mitigation selection guide + -------------------------- +--- a/Documentation/hw-vuln/tsx_async_abort.rst ++++ b/Documentation/hw-vuln/tsx_async_abort.rst +@@ -174,7 +174,10 @@ the option "tsx_async_abort=". The valid + CPU is not vulnerable to cross-thread TAA attacks. + ============ ============================================================= + +-Not specifying this option is equivalent to "tsx_async_abort=full". ++Not specifying this option is equivalent to "tsx_async_abort=full". For ++processors that are affected by both TAA and MDS, specifying just ++"tsx_async_abort=off" without an accompanying "mds=off" will have no ++effect as the same mitigation is used for both vulnerabilities. + + The kernel command line also allows to control the TSX feature using the + parameter "tsx=" on CPUs which support TSX control. MSR_IA32_TSX_CTRL is used +--- a/Documentation/kernel-parameters.txt ++++ b/Documentation/kernel-parameters.txt +@@ -2365,6 +2365,12 @@ bytes respectively. Such letter suffixes + SMT on vulnerable CPUs + off - Unconditionally disable MDS mitigation + ++ On TAA-affected machines, mds=off can be prevented by ++ an active TAA mitigation as both vulnerabilities are ++ mitigated with the same mechanism so in order to disable ++ this mitigation, you need to specify tsx_async_abort=off ++ too. ++ + Not specifying this option is equivalent to + mds=full. + +@@ -4599,6 +4605,11 @@ bytes respectively. Such letter suffixes + vulnerable to cross-thread TAA attacks. + off - Unconditionally disable TAA mitigation + ++ On MDS-affected machines, tsx_async_abort=off can be ++ prevented by an active MDS mitigation as both vulnerabilities ++ are mitigated with the same mechanism so in order to disable ++ this mitigation, you need to specify mds=off too. ++ + Not specifying this option is equivalent to + tsx_async_abort=full. On CPUs which are MDS affected + and deploy MDS mitigation, TAA mitigation is not +--- a/arch/x86/kernel/cpu/bugs.c ++++ b/arch/x86/kernel/cpu/bugs.c +@@ -303,8 +303,12 @@ static void __init taa_select_mitigation + return; + } + +- /* TAA mitigation is turned off on the cmdline (tsx_async_abort=off) */ +- if (taa_mitigation == TAA_MITIGATION_OFF) ++ /* ++ * TAA mitigation via VERW is turned off if both ++ * tsx_async_abort=off and mds=off are specified. ++ */ ++ if (taa_mitigation == TAA_MITIGATION_OFF && ++ mds_mitigation == MDS_MITIGATION_OFF) + goto out; + + if (boot_cpu_has(X86_FEATURE_MD_CLEAR)) +@@ -338,6 +342,15 @@ static void __init taa_select_mitigation + if (taa_nosmt || cpu_mitigations_auto_nosmt()) + cpu_smt_disable(false); + ++ /* ++ * Update MDS mitigation, if necessary, as the mds_user_clear is ++ * now enabled for TAA mitigation. ++ */ ++ if (mds_mitigation == MDS_MITIGATION_OFF && ++ boot_cpu_has_bug(X86_BUG_MDS)) { ++ mds_mitigation = MDS_MITIGATION_FULL; ++ mds_select_mitigation(); ++ } + out: + pr_info("%s\n", taa_strings[taa_mitigation]); + } diff --git a/queue-4.9/x86-speculation-fix-redundant-mds-mitigation-message.patch b/queue-4.9/x86-speculation-fix-redundant-mds-mitigation-message.patch new file mode 100644 index 00000000000..2ee47e73ce7 --- /dev/null +++ b/queue-4.9/x86-speculation-fix-redundant-mds-mitigation-message.patch @@ -0,0 +1,81 @@ +From cd5a2aa89e847bdda7b62029d94e95488d73f6b2 Mon Sep 17 00:00:00 2001 +From: Waiman Long +Date: Fri, 15 Nov 2019 11:14:45 -0500 +Subject: x86/speculation: Fix redundant MDS mitigation message + +From: Waiman Long + +commit cd5a2aa89e847bdda7b62029d94e95488d73f6b2 upstream. + +Since MDS and TAA mitigations are inter-related for processors that are +affected by both vulnerabilities, the followiing confusing messages can +be printed in the kernel log: + + MDS: Vulnerable + MDS: Mitigation: Clear CPU buffers + +To avoid the first incorrect message, defer the printing of MDS +mitigation after the TAA mitigation selection has been done. However, +that has the side effect of printing TAA mitigation first before MDS +mitigation. + + [ bp: Check box is affected/mitigations are disabled first before + printing and massage. ] + +Suggested-by: Pawan Gupta +Signed-off-by: Waiman Long +Signed-off-by: Borislav Petkov +Cc: Greg Kroah-Hartman +Cc: "H. Peter Anvin" +Cc: Ingo Molnar +Cc: Josh Poimboeuf +Cc: Mark Gross +Cc: Peter Zijlstra +Cc: Thomas Gleixner +Cc: Tim Chen +Cc: Tony Luck +Cc: Tyler Hicks +Cc: x86-ml +Link: https://lkml.kernel.org/r/20191115161445.30809-3-longman@redhat.com +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/kernel/cpu/bugs.c | 13 +++++++++++++ + 1 file changed, 13 insertions(+) + +--- a/arch/x86/kernel/cpu/bugs.c ++++ b/arch/x86/kernel/cpu/bugs.c +@@ -38,6 +38,7 @@ static void __init spectre_v2_select_mit + static void __init ssb_select_mitigation(void); + static void __init l1tf_select_mitigation(void); + static void __init mds_select_mitigation(void); ++static void __init mds_print_mitigation(void); + static void __init taa_select_mitigation(void); + + /* The base value of the SPEC_CTRL MSR that always has to be preserved. */ +@@ -107,6 +108,12 @@ void __init check_bugs(void) + mds_select_mitigation(); + taa_select_mitigation(); + ++ /* ++ * As MDS and TAA mitigations are inter-related, print MDS ++ * mitigation until after TAA mitigation selection is done. ++ */ ++ mds_print_mitigation(); ++ + arch_smt_update(); + + #ifdef CONFIG_X86_32 +@@ -244,6 +251,12 @@ static void __init mds_select_mitigation + (mds_nosmt || cpu_mitigations_auto_nosmt())) + cpu_smt_disable(false); + } ++} ++ ++static void __init mds_print_mitigation(void) ++{ ++ if (!boot_cpu_has_bug(X86_BUG_MDS) || cpu_mitigations_off()) ++ return; + + pr_info("%s\n", mds_strings[mds_mitigation]); + }