From: Greg Kroah-Hartman Date: Wed, 3 Apr 2019 13:57:20 +0000 (+0200) Subject: 4.9-stable patches X-Git-Tag: v4.9.168~21 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=9a9cdbc00ac31dc6e39a1903abc69cad0a0fca9d;p=thirdparty%2Fkernel%2Fstable-queue.git 4.9-stable patches added patches: arm64-debug-don-t-propagate-unknown-far-into-si_code-for-debug-signals.patch arm64-debug-ensure-debug-handlers-check-triggering-exception-level.patch --- diff --git a/queue-4.9/arm64-debug-don-t-propagate-unknown-far-into-si_code-for-debug-signals.patch b/queue-4.9/arm64-debug-don-t-propagate-unknown-far-into-si_code-for-debug-signals.patch new file mode 100644 index 00000000000..496036ce307 --- /dev/null +++ b/queue-4.9/arm64-debug-don-t-propagate-unknown-far-into-si_code-for-debug-signals.patch @@ -0,0 +1,68 @@ +From b9a4b9d084d978f80eb9210727c81804588b42ff Mon Sep 17 00:00:00 2001 +From: Will Deacon +Date: Fri, 1 Mar 2019 13:28:00 +0000 +Subject: arm64: debug: Don't propagate UNKNOWN FAR into si_code for debug signals + +From: Will Deacon + +commit b9a4b9d084d978f80eb9210727c81804588b42ff upstream. + +FAR_EL1 is UNKNOWN for all debug exceptions other than those caused by +taking a hardware watchpoint. Unfortunately, if a debug handler returns +a non-zero value, then we will propagate the UNKNOWN FAR value to +userspace via the si_addr field of the SIGTRAP siginfo_t. + +Instead, let's set si_addr to take on the PC of the faulting instruction, +which we have available in the current pt_regs. + +Cc: +Reviewed-by: Mark Rutland +Signed-off-by: Will Deacon +Signed-off-by: Catalin Marinas +Signed-off-by: Greg Kroah-Hartman + + +--- + arch/arm64/mm/fault.c | 11 ++++++----- + 1 file changed, 6 insertions(+), 5 deletions(-) + +--- a/arch/arm64/mm/fault.c ++++ b/arch/arm64/mm/fault.c +@@ -673,11 +673,12 @@ void __init hook_debug_fault_code(int nr + debug_fault_info[nr].name = name; + } + +-asmlinkage int __exception do_debug_exception(unsigned long addr, ++asmlinkage int __exception do_debug_exception(unsigned long addr_if_watchpoint, + unsigned int esr, + struct pt_regs *regs) + { + const struct fault_info *inf = debug_fault_info + DBG_ESR_EVT(esr); ++ unsigned long pc = instruction_pointer(regs); + struct siginfo info; + int rv; + +@@ -688,19 +689,19 @@ asmlinkage int __exception do_debug_exce + if (interrupts_enabled(regs)) + trace_hardirqs_off(); + +- if (user_mode(regs) && instruction_pointer(regs) > TASK_SIZE) ++ if (user_mode(regs) && pc > TASK_SIZE) + arm64_apply_bp_hardening(); + +- if (!inf->fn(addr, esr, regs)) { ++ if (!inf->fn(addr_if_watchpoint, esr, regs)) { + rv = 1; + } else { + pr_alert("Unhandled debug exception: %s (0x%08x) at 0x%016lx\n", +- inf->name, esr, addr); ++ inf->name, esr, pc); + + info.si_signo = inf->sig; + info.si_errno = 0; + info.si_code = inf->code; +- info.si_addr = (void __user *)addr; ++ info.si_addr = (void __user *)pc; + arm64_notify_die("", regs, &info, 0); + rv = 0; + } diff --git a/queue-4.9/arm64-debug-ensure-debug-handlers-check-triggering-exception-level.patch b/queue-4.9/arm64-debug-ensure-debug-handlers-check-triggering-exception-level.patch new file mode 100644 index 00000000000..dc9bfff13c6 --- /dev/null +++ b/queue-4.9/arm64-debug-ensure-debug-handlers-check-triggering-exception-level.patch @@ -0,0 +1,93 @@ +From 6bd288569b50bc89fa5513031086746968f585cb Mon Sep 17 00:00:00 2001 +From: Will Deacon +Date: Fri, 1 Mar 2019 13:28:01 +0000 +Subject: arm64: debug: Ensure debug handlers check triggering exception level + +From: Will Deacon + +commit 6bd288569b50bc89fa5513031086746968f585cb upstream. + +Debug exception handlers may be called for exceptions generated both by +user and kernel code. In many cases, this is checked explicitly, but +in other cases things either happen to work by happy accident or they +go slightly wrong. For example, executing 'brk #4' from userspace will +enter the kprobes code and be ignored, but the instruction will be +retried forever in userspace instead of delivering a SIGTRAP. + +Fix this issue in the most stable-friendly fashion by simply adding +explicit checks of the triggering exception level to all of our debug +exception handlers. + +Cc: +Reviewed-by: Mark Rutland +Signed-off-by: Will Deacon +Signed-off-by: Catalin Marinas +Signed-off-by: Greg Kroah-Hartman + + +--- + arch/arm64/kernel/kgdb.c | 15 ++++++++++++--- + arch/arm64/kernel/probes/kprobes.c | 6 ++++++ + 2 files changed, 18 insertions(+), 3 deletions(-) + +--- a/arch/arm64/kernel/kgdb.c ++++ b/arch/arm64/kernel/kgdb.c +@@ -231,24 +231,33 @@ int kgdb_arch_handle_exception(int excep + + static int kgdb_brk_fn(struct pt_regs *regs, unsigned int esr) + { ++ if (user_mode(regs)) ++ return DBG_HOOK_ERROR; ++ + kgdb_handle_exception(1, SIGTRAP, 0, regs); +- return 0; ++ return DBG_HOOK_HANDLED; + } + NOKPROBE_SYMBOL(kgdb_brk_fn) + + static int kgdb_compiled_brk_fn(struct pt_regs *regs, unsigned int esr) + { ++ if (user_mode(regs)) ++ return DBG_HOOK_ERROR; ++ + compiled_break = 1; + kgdb_handle_exception(1, SIGTRAP, 0, regs); + +- return 0; ++ return DBG_HOOK_HANDLED; + } + NOKPROBE_SYMBOL(kgdb_compiled_brk_fn); + + static int kgdb_step_brk_fn(struct pt_regs *regs, unsigned int esr) + { ++ if (user_mode(regs)) ++ return DBG_HOOK_ERROR; ++ + kgdb_handle_exception(1, SIGTRAP, 0, regs); +- return 0; ++ return DBG_HOOK_HANDLED; + } + NOKPROBE_SYMBOL(kgdb_step_brk_fn); + +--- a/arch/arm64/kernel/probes/kprobes.c ++++ b/arch/arm64/kernel/probes/kprobes.c +@@ -450,6 +450,9 @@ kprobe_single_step_handler(struct pt_reg + struct kprobe_ctlblk *kcb = get_kprobe_ctlblk(); + int retval; + ++ if (user_mode(regs)) ++ return DBG_HOOK_ERROR; ++ + /* return error if this is not our step */ + retval = kprobe_ss_hit(kcb, instruction_pointer(regs)); + +@@ -466,6 +469,9 @@ kprobe_single_step_handler(struct pt_reg + int __kprobes + kprobe_breakpoint_handler(struct pt_regs *regs, unsigned int esr) + { ++ if (user_mode(regs)) ++ return DBG_HOOK_ERROR; ++ + kprobe_handler(regs); + return DBG_HOOK_HANDLED; + }