From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Sun, 11 Sep 2022 05:48:32 +0000 (+0200)
Subject: 5.4-stable patches
X-Git-Tag: v5.19.9~30
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=289822b6498d23bae0b9d328d2c9e09405b22635;p=thirdparty%2Fkernel%2Fstable-queue.git

5.4-stable patches

added patches:
	x86-nospec-fix-i386-rsb-stuffing.patch
---

diff --git a/queue-5.4/series b/queue-5.4/series
index 68fd4e129d9..7ca70e15111 100644
--- a/queue-5.4/series
+++ b/queue-5.4/series
@@ -104,3 +104,4 @@ rdma-mlx5-set-local-port-to-one-when-accessing-count.patch
 nvme-tcp-fix-uaf-when-detecting-digest-errors.patch
 tcp-fix-early-etimedout-after-spurious-non-sack-rto.patch
 sch_sfb-also-store-skb-len-before-calling-child-enqu.patch
+x86-nospec-fix-i386-rsb-stuffing.patch
diff --git a/queue-5.4/x86-nospec-fix-i386-rsb-stuffing.patch b/queue-5.4/x86-nospec-fix-i386-rsb-stuffing.patch
new file mode 100644
index 00000000000..45cac70d88f
--- /dev/null
+++ b/queue-5.4/x86-nospec-fix-i386-rsb-stuffing.patch
@@ -0,0 +1,56 @@
+From foo@baz Sun Sep 11 07:47:57 AM CEST 2022
+From: Peter Zijlstra <peterz@infradead.org>
+Date: Fri, 19 Aug 2022 13:01:35 +0200
+Subject: x86/nospec: Fix i386 RSB stuffing
+
+From: Peter Zijlstra <peterz@infradead.org>
+
+commit 332924973725e8cdcc783c175f68cf7e162cb9e5 upstream.
+
+Turns out that i386 doesn't unconditionally have LFENCE, as such the
+loop in __FILL_RETURN_BUFFER isn't actually speculation safe on such
+chips.
+
+Fixes: ba6e31af2be9 ("x86/speculation: Add LFENCE to RSB fill sequence")
+Reported-by: Ben Hutchings <ben@decadent.org.uk>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Link: https://lkml.kernel.org/r/Yv9tj9vbQ9nNlXoY@worktop.programming.kicks-ass.net
+[bwh: Backported to 4.19/5.4:
+ - __FILL_RETURN_BUFFER takes an sp parameter
+ - Open-code __FILL_RETURN_SLOT]
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/x86/include/asm/nospec-branch.h |   14 ++++++++++++++
+ 1 file changed, 14 insertions(+)
+
+--- a/arch/x86/include/asm/nospec-branch.h
++++ b/arch/x86/include/asm/nospec-branch.h
+@@ -44,6 +44,7 @@
+  * the optimal version — two calls, each with their own speculation
+  * trap should their return address end up getting used, in a loop.
+  */
++#ifdef CONFIG_X86_64
+ #define __FILL_RETURN_BUFFER(reg, nr, sp)	\
+ 	mov	$(nr/2), reg;			\
+ 771:						\
+@@ -64,6 +65,19 @@
+ 	add	$(BITS_PER_LONG/8) * nr, sp;	\
+ 	/* barrier for jnz misprediction */	\
+ 	lfence;
++#else
++/*
++ * i386 doesn't unconditionally have LFENCE, as such it can't
++ * do a loop.
++ */
++#define __FILL_RETURN_BUFFER(reg, nr, sp)	\
++	.rept nr;				\
++	call	772f;				\
++	int3;					\
++772:;						\
++	.endr;					\
++	add	$(BITS_PER_LONG/8) * nr, sp;
++#endif
+ 
+ #define __ISSUE_UNBALANCED_RET_GUARD(sp)	\
+ 	call	881f;				\