5.15-stable patches

added patches:
	phy-tegra-xusb-fix-return-value-of-tegra_xusb_find_port_node-function.patch
	powerpc-rtas-prevent-spectre-v1-gadget-construction-in-sys_rtas.patch
	x86-pvh-call-c-code-via-the-kernel-virtual-mapping.patch

diff --git a/queue-5.15/phy-tegra-xusb-fix-return-value-of-tegra_xusb_find_port_node-function.patch b/queue-5.15/phy-tegra-xusb-fix-return-value-of-tegra_xusb_find_port_node-function.patch
new file mode 100644 (file)
index 0000000..04236b1
--- /dev/null
+++ b/queue-5.15/phy-tegra-xusb-fix-return-value-of-tegra_xusb_find_port_node-function.patch
@@ -0,0 +1,34 @@
+From 045a31b95509c8f25f5f04ec5e0dec5cd09f2c5f Mon Sep 17 00:00:00 2001
+From: Miaoqian Lin <linmq006@gmail.com>
+Date: Mon, 13 Dec 2021 02:05:07 +0000
+Subject: phy: tegra: xusb: Fix return value of tegra_xusb_find_port_node function
+
+From: Miaoqian Lin <linmq006@gmail.com>
+
+commit 045a31b95509c8f25f5f04ec5e0dec5cd09f2c5f upstream.
+
+callers of tegra_xusb_find_port_node() function only do NULL checking for
+the return value. return NULL instead of ERR_PTR(-ENOMEM) to keep
+consistent.
+
+Signed-off-by: Miaoqian Lin <linmq006@gmail.com>
+Acked-by: Thierry Reding <treding@nvidia.com>
+Link: https://lore.kernel.org/r/20211213020507.1458-1-linmq006@gmail.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Alva Lan <alvalan9@foxmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/phy/tegra/xusb.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/phy/tegra/xusb.c
++++ b/drivers/phy/tegra/xusb.c
+@@ -455,7 +455,7 @@ tegra_xusb_find_port_node(struct tegra_x
+       name = kasprintf(GFP_KERNEL, "%s-%u", type, index);
+       if (!name) {
+               of_node_put(ports);
+-              return ERR_PTR(-ENOMEM);
++              return NULL;
+       }
+       np = of_get_child_by_name(ports, name);
+       kfree(name);

diff --git a/queue-5.15/powerpc-rtas-prevent-spectre-v1-gadget-construction-in-sys_rtas.patch b/queue-5.15/powerpc-rtas-prevent-spectre-v1-gadget-construction-in-sys_rtas.patch
new file mode 100644 (file)
index 0000000..3710ce4
--- /dev/null
+++ b/queue-5.15/powerpc-rtas-prevent-spectre-v1-gadget-construction-in-sys_rtas.patch
@@ -0,0 +1,54 @@
+From 0974d03eb479384466d828d65637814bee6b26d7 Mon Sep 17 00:00:00 2001
+From: Nathan Lynch <nathanl@linux.ibm.com>
+Date: Thu, 30 May 2024 19:44:12 -0500
+Subject: powerpc/rtas: Prevent Spectre v1 gadget construction in sys_rtas()
+
+From: Nathan Lynch <nathanl@linux.ibm.com>
+
+commit 0974d03eb479384466d828d65637814bee6b26d7 upstream.
+
+Smatch warns:
+
+  arch/powerpc/kernel/rtas.c:1932 __do_sys_rtas() warn: potential
+  spectre issue 'args.args' [r] (local cap)
+
+The 'nargs' and 'nret' locals come directly from a user-supplied
+buffer and are used as indexes into a small stack-based array and as
+inputs to copy_to_user() after they are subject to bounds checks.
+
+Use array_index_nospec() after the bounds checks to clamp these values
+for speculative execution.
+
+Signed-off-by: Nathan Lynch <nathanl@linux.ibm.com>
+Reported-by: Breno Leitao <leitao@debian.org>
+Reviewed-by: Breno Leitao <leitao@debian.org>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://msgid.link/20240530-sys_rtas-nargs-nret-v1-1-129acddd4d89@linux.ibm.com
+[Minor context change fixed]
+Signed-off-by: Cliff Liu <donghua.liu@windriver.com>
+Signed-off-by: He Zhe <Zhe.He@windriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/powerpc/kernel/rtas.c |    4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/arch/powerpc/kernel/rtas.c
++++ b/arch/powerpc/kernel/rtas.c
+@@ -16,6 +16,7 @@
+ #include <linux/capability.h>
+ #include <linux/delay.h>
+ #include <linux/cpu.h>
++#include <linux/nospec.h>
+ #include <linux/sched.h>
+ #include <linux/smp.h>
+ #include <linux/completion.h>
+@@ -1076,6 +1077,9 @@ SYSCALL_DEFINE1(rtas, struct rtas_args _
+           || nargs + nret > ARRAY_SIZE(args.args))
+               return -EINVAL;
+ 
++      nargs = array_index_nospec(nargs, ARRAY_SIZE(args.args));
++      nret = array_index_nospec(nret, ARRAY_SIZE(args.args) - nargs);
++
+       /* Copy in args. */
+       if (copy_from_user(args.args, uargs->args,
+                          nargs * sizeof(rtas_arg_t)) != 0)

diff --git a/queue-5.15/series b/queue-5.15/series
index 2d983a0458a2a611477a40fe66c864f4e38e2298..9a68de0f79c2b1f174c9d6eaa09bd7c638b07976 100644 (file)
--- a/queue-5.15/series
+++ b/queue-5.15/series
@@ -206,3 +206,6 @@ filemap-fix-bounds-checking-in-filemap_read.patch
 phonet-pep-fix-racy-skb_queue_empty-use.patch
 bnxt_re-avoid-shift-undefined-behavior-in-bnxt_qplib_alloc_init_hwq.patch
 net-mana-fix-error-handling-in-mana_create_txq-rxq-s-napi-cleanup.patch
+x86-pvh-call-c-code-via-the-kernel-virtual-mapping.patch
+powerpc-rtas-prevent-spectre-v1-gadget-construction-in-sys_rtas.patch
+phy-tegra-xusb-fix-return-value-of-tegra_xusb_find_port_node-function.patch

diff --git a/queue-5.15/x86-pvh-call-c-code-via-the-kernel-virtual-mapping.patch b/queue-5.15/x86-pvh-call-c-code-via-the-kernel-virtual-mapping.patch
new file mode 100644 (file)
index 0000000..a9722b0
--- /dev/null
+++ b/queue-5.15/x86-pvh-call-c-code-via-the-kernel-virtual-mapping.patch
@@ -0,0 +1,49 @@
+From e8fbc0d9cab6c1ee6403f42c0991b0c1d5dbc092 Mon Sep 17 00:00:00 2001
+From: Ard Biesheuvel <ardb@kernel.org>
+Date: Wed, 9 Oct 2024 18:04:40 +0200
+Subject: x86/pvh: Call C code via the kernel virtual mapping
+
+From: Ard Biesheuvel <ardb@kernel.org>
+
+commit e8fbc0d9cab6c1ee6403f42c0991b0c1d5dbc092 upstream.
+
+Calling C code via a different mapping than it was linked at is
+problematic, because the compiler assumes that RIP-relative and absolute
+symbol references are interchangeable. GCC in particular may use
+RIP-relative per-CPU variable references even when not using -fpic.
+
+So call xen_prepare_pvh() via its kernel virtual mapping on x86_64, so
+that those RIP-relative references produce the correct values. This
+matches the pre-existing behavior for i386, which also invokes
+xen_prepare_pvh() via the kernel virtual mapping before invoking
+startup_32 with paging disabled again.
+
+Fixes: 7243b93345f7 ("xen/pvh: Bootstrap PVH guest")
+Tested-by: Jason Andryuk <jason.andryuk@amd.com>
+Reviewed-by: Jason Andryuk <jason.andryuk@amd.com>
+Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
+Message-ID: <20241009160438.3884381-8-ardb+git@google.com>
+Signed-off-by: Juergen Gross <jgross@suse.com>
+[ Stable context update ]
+Signed-off-by: Jason Andryuk <jason.andryuk@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/x86/platform/pvh/head.S |    7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+--- a/arch/x86/platform/pvh/head.S
++++ b/arch/x86/platform/pvh/head.S
+@@ -99,7 +99,12 @@ SYM_CODE_START_LOCAL(pvh_start_xen)
+       xor %edx, %edx
+       wrmsr
+ 
+-      call xen_prepare_pvh
++      /* Call xen_prepare_pvh() via the kernel virtual mapping */
++      leaq xen_prepare_pvh(%rip), %rax
++      subq phys_base(%rip), %rax
++      addq $__START_KERNEL_map, %rax
++      ANNOTATE_RETPOLINE_SAFE
++      call *%rax
+ 
+       /* startup_64 expects boot_params in %rsi. */
+       mov $_pa(pvh_bootparams), %rsi