From: Greg Kroah-Hartman Date: Wed, 14 May 2025 12:12:18 +0000 (+0200) Subject: 6.1-stable patches X-Git-Tag: v5.15.183~7 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=c0203c5800a4893dba6879c5a29ca0cac4c200ea;p=thirdparty%2Fkernel%2Fstable-queue.git 6.1-stable patches added patches: x86-its-fineibt-paranoid-vs-its.patch --- diff --git a/queue-6.1/series b/queue-6.1/series index 6731db2f89..b4afa4f61b 100644 --- a/queue-6.1/series +++ b/queue-6.1/series @@ -93,3 +93,4 @@ x86-its-use-dynamic-thunks-for-indirect-branches.patch x86-its-fix-build-errors-when-config_modules-n.patch x86-alternative-optimize-returns-patching.patch x86-alternatives-remove-faulty-optimization.patch +x86-its-fineibt-paranoid-vs-its.patch diff --git a/queue-6.1/x86-its-fineibt-paranoid-vs-its.patch b/queue-6.1/x86-its-fineibt-paranoid-vs-its.patch new file mode 100644 index 0000000000..70569742e8 --- /dev/null +++ b/queue-6.1/x86-its-fineibt-paranoid-vs-its.patch @@ -0,0 +1,117 @@ +From e52c1dc7455d32c8a55f9949d300e5e87d011fa6 Mon Sep 17 00:00:00 2001 +From: Peter Zijlstra +Date: Wed, 23 Apr 2025 09:57:31 +0200 +Subject: x86/its: FineIBT-paranoid vs ITS + +From: Peter Zijlstra + +commit e52c1dc7455d32c8a55f9949d300e5e87d011fa6 upstream. + +FineIBT-paranoid was using the retpoline bytes for the paranoid check, +disabling retpolines, because all parts that have IBT also have eIBRS +and thus don't need no stinking retpolines. + +Except... ITS needs the retpolines for indirect calls must not be in +the first half of a cacheline :-/ + +So what was the paranoid call sequence: + + : + 0: 41 ba 78 56 34 12 mov $0x12345678, %r10d + 6: 45 3b 53 f7 cmp -0x9(%r11), %r10d + a: 4d 8d 5b lea -0x10(%r11), %r11 + e: 75 fd jne d + 10: 41 ff d3 call *%r11 + 13: 90 nop + +Now becomes: + + : + 0: 41 ba 78 56 34 12 mov $0x12345678, %r10d + 6: 45 3b 53 f7 cmp -0x9(%r11), %r10d + a: 4d 8d 5b f0 lea -0x10(%r11), %r11 + e: 2e e8 XX XX XX XX cs call __x86_indirect_paranoid_thunk_r11 + + Where the paranoid_thunk looks like: + + 1d: (bad) + __x86_indirect_paranoid_thunk_r11: + 1e: 75 fd jne 1d + __x86_indirect_its_thunk_r11: + 20: 41 ff eb jmp *%r11 + 23: cc int3 + +[ dhansen: remove initialization to false ] + +Signed-off-by: Peter Zijlstra (Intel) +Signed-off-by: Pawan Gupta +Signed-off-by: Dave Hansen +Reviewed-by: Alexandre Chartre +[ Just a portion of the original commit, in order to fix a build issue + in stable kernels due to backports ] +Reported-by: Holger Hoffstätte +Link: https://lore.kernel.org/r/20250514113952.GB16434@noisy.programming.kicks-ass.net +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/include/asm/alternative.h | 8 ++++++++ + arch/x86/kernel/alternative.c | 8 ++++++++ + arch/x86/net/bpf_jit_comp.c | 2 +- + 3 files changed, 17 insertions(+), 1 deletion(-) + +--- a/arch/x86/include/asm/alternative.h ++++ b/arch/x86/include/asm/alternative.h +@@ -5,6 +5,7 @@ + #include + #include + #include ++#include + + #define ALTINSTR_FLAG_INV (1 << 15) + #define ALT_NOT(feat) ((feat) | ALTINSTR_FLAG_INV) +@@ -85,10 +86,17 @@ struct module; + extern void its_init_mod(struct module *mod); + extern void its_fini_mod(struct module *mod); + extern void its_free_mod(struct module *mod); ++extern u8 *its_static_thunk(int reg); + #else /* CONFIG_MITIGATION_ITS */ + static inline void its_init_mod(struct module *mod) { } + static inline void its_fini_mod(struct module *mod) { } + static inline void its_free_mod(struct module *mod) { } ++static inline u8 *its_static_thunk(int reg) ++{ ++ WARN_ONCE(1, "ITS not compiled in"); ++ ++ return NULL; ++} + #endif + + #if defined(CONFIG_RETHUNK) && defined(CONFIG_OBJTOOL) +--- a/arch/x86/kernel/alternative.c ++++ b/arch/x86/kernel/alternative.c +@@ -593,6 +593,14 @@ static bool cpu_wants_indirect_its_thunk + /* Lower-half of the cacheline? */ + return !(addr & 0x20); + } ++ ++u8 *its_static_thunk(int reg) ++{ ++ u8 *thunk = __x86_indirect_its_thunk_array[reg]; ++ ++ return thunk; ++} ++ + #endif + + /* +--- a/arch/x86/net/bpf_jit_comp.c ++++ b/arch/x86/net/bpf_jit_comp.c +@@ -467,7 +467,7 @@ static void emit_indirect_jump(u8 **ppro + if (IS_ENABLED(CONFIG_MITIGATION_ITS) && + cpu_feature_enabled(X86_FEATURE_INDIRECT_THUNK_ITS)) { + OPTIMIZER_HIDE_VAR(reg); +- emit_jump(&prog, &__x86_indirect_its_thunk_array[reg], ip); ++ emit_jump(&prog, its_static_thunk(reg), ip); + } else if (cpu_feature_enabled(X86_FEATURE_RETPOLINE_LFENCE)) { + EMIT_LFENCE(); + EMIT2(0xFF, 0xE0 + reg);