From: Greg Kroah-Hartman Date: Wed, 3 Apr 2019 13:57:02 +0000 (+0200) Subject: 4.4-stable patches X-Git-Tag: v4.9.168~22 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=501b51ffae6780e68ad33efd522ad4b6fc2377b5;p=thirdparty%2Fkernel%2Fstable-queue.git 4.4-stable patches added patches: arm64-debug-don-t-propagate-unknown-far-into-si_code-for-debug-signals.patch arm64-debug-ensure-debug-handlers-check-triggering-exception-level.patch --- diff --git a/queue-4.14/series b/queue-4.14/series new file mode 100644 index 00000000000..e7069e23242 --- /dev/null +++ b/queue-4.14/series @@ -0,0 +1 @@ +arm64-debug-don-t-propagate-unknown-far-into-si_code-for-debug-signals.patch diff --git a/queue-4.19/series b/queue-4.19/series new file mode 100644 index 00000000000..e7069e23242 --- /dev/null +++ b/queue-4.19/series @@ -0,0 +1 @@ +arm64-debug-don-t-propagate-unknown-far-into-si_code-for-debug-signals.patch diff --git a/queue-4.4/arm64-debug-don-t-propagate-unknown-far-into-si_code-for-debug-signals.patch b/queue-4.4/arm64-debug-don-t-propagate-unknown-far-into-si_code-for-debug-signals.patch new file mode 100644 index 00000000000..200ed85b651 --- /dev/null +++ b/queue-4.4/arm64-debug-don-t-propagate-unknown-far-into-si_code-for-debug-signals.patch @@ -0,0 +1,64 @@ +From b9a4b9d084d978f80eb9210727c81804588b42ff Mon Sep 17 00:00:00 2001 +From: Will Deacon +Date: Fri, 1 Mar 2019 13:28:00 +0000 +Subject: arm64: debug: Don't propagate UNKNOWN FAR into si_code for debug signals + +From: Will Deacon + +commit b9a4b9d084d978f80eb9210727c81804588b42ff upstream. + +FAR_EL1 is UNKNOWN for all debug exceptions other than those caused by +taking a hardware watchpoint. Unfortunately, if a debug handler returns +a non-zero value, then we will propagate the UNKNOWN FAR value to +userspace via the si_addr field of the SIGTRAP siginfo_t. + +Instead, let's set si_addr to take on the PC of the faulting instruction, +which we have available in the current pt_regs. + +Cc: +Reviewed-by: Mark Rutland +Signed-off-by: Will Deacon +Signed-off-by: Catalin Marinas +Signed-off-by: Greg Kroah-Hartman + + +--- + arch/arm64/mm/fault.c | 9 +++++---- + 1 file changed, 5 insertions(+), 4 deletions(-) + +--- a/arch/arm64/mm/fault.c ++++ b/arch/arm64/mm/fault.c +@@ -589,11 +589,12 @@ void __init hook_debug_fault_code(int nr + debug_fault_info[nr].name = name; + } + +-asmlinkage int __exception do_debug_exception(unsigned long addr, ++asmlinkage int __exception do_debug_exception(unsigned long addr_if_watchpoint, + unsigned int esr, + struct pt_regs *regs) + { + const struct fault_info *inf = debug_fault_info + DBG_ESR_EVT(esr); ++ unsigned long pc = instruction_pointer(regs); + struct siginfo info; + int rv; + +@@ -604,16 +605,16 @@ asmlinkage int __exception do_debug_exce + if (interrupts_enabled(regs)) + trace_hardirqs_off(); + +- if (!inf->fn(addr, esr, regs)) { ++ if (!inf->fn(addr_if_watchpoint, esr, regs)) { + rv = 1; + } else { + pr_alert("Unhandled debug exception: %s (0x%08x) at 0x%016lx\n", +- inf->name, esr, addr); ++ inf->name, esr, pc); + + info.si_signo = inf->sig; + info.si_errno = 0; + info.si_code = inf->code; +- info.si_addr = (void __user *)addr; ++ info.si_addr = (void __user *)pc; + arm64_notify_die("", regs, &info, 0); + rv = 0; + } diff --git a/queue-4.4/arm64-debug-ensure-debug-handlers-check-triggering-exception-level.patch b/queue-4.4/arm64-debug-ensure-debug-handlers-check-triggering-exception-level.patch new file mode 100644 index 00000000000..632865acd22 --- /dev/null +++ b/queue-4.4/arm64-debug-ensure-debug-handlers-check-triggering-exception-level.patch @@ -0,0 +1,67 @@ +From 6bd288569b50bc89fa5513031086746968f585cb Mon Sep 17 00:00:00 2001 +From: Will Deacon +Date: Fri, 1 Mar 2019 13:28:01 +0000 +Subject: arm64: debug: Ensure debug handlers check triggering exception level + +From: Will Deacon + +commit 6bd288569b50bc89fa5513031086746968f585cb upstream. + +Debug exception handlers may be called for exceptions generated both by +user and kernel code. In many cases, this is checked explicitly, but +in other cases things either happen to work by happy accident or they +go slightly wrong. For example, executing 'brk #4' from userspace will +enter the kprobes code and be ignored, but the instruction will be +retried forever in userspace instead of delivering a SIGTRAP. + +Fix this issue in the most stable-friendly fashion by simply adding +explicit checks of the triggering exception level to all of our debug +exception handlers. + +Cc: +Reviewed-by: Mark Rutland +Signed-off-by: Will Deacon +Signed-off-by: Catalin Marinas +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm64/kernel/kgdb.c | 15 ++++++++++++--- + 1 file changed, 12 insertions(+), 3 deletions(-) + +--- a/arch/arm64/kernel/kgdb.c ++++ b/arch/arm64/kernel/kgdb.c +@@ -215,22 +215,31 @@ int kgdb_arch_handle_exception(int excep + + static int kgdb_brk_fn(struct pt_regs *regs, unsigned int esr) + { ++ if (user_mode(regs)) ++ return DBG_HOOK_ERROR; ++ + kgdb_handle_exception(1, SIGTRAP, 0, regs); +- return 0; ++ return DBG_HOOK_HANDLED; + } + + static int kgdb_compiled_brk_fn(struct pt_regs *regs, unsigned int esr) + { ++ if (user_mode(regs)) ++ return DBG_HOOK_ERROR; ++ + compiled_break = 1; + kgdb_handle_exception(1, SIGTRAP, 0, regs); + +- return 0; ++ return DBG_HOOK_HANDLED; + } + + static int kgdb_step_brk_fn(struct pt_regs *regs, unsigned int esr) + { ++ if (user_mode(regs)) ++ return DBG_HOOK_ERROR; ++ + kgdb_handle_exception(1, SIGTRAP, 0, regs); +- return 0; ++ return DBG_HOOK_HANDLED; + } + + static struct break_hook kgdb_brkpt_hook = { diff --git a/queue-4.4/series b/queue-4.4/series new file mode 100644 index 00000000000..43ec6919ab9 --- /dev/null +++ b/queue-4.4/series @@ -0,0 +1,2 @@ +arm64-debug-don-t-propagate-unknown-far-into-si_code-for-debug-signals.patch +arm64-debug-ensure-debug-handlers-check-triggering-exception-level.patch diff --git a/queue-4.9/series b/queue-4.9/series new file mode 100644 index 00000000000..43ec6919ab9 --- /dev/null +++ b/queue-4.9/series @@ -0,0 +1,2 @@ +arm64-debug-don-t-propagate-unknown-far-into-si_code-for-debug-signals.patch +arm64-debug-ensure-debug-handlers-check-triggering-exception-level.patch