4.19-stable patches

added patches:
	x86-nospec-fix-i386-rsb-stuffing.patch

diff --git a/queue-4.19/series b/queue-4.19/series
index e776491f0467a2852870b4f62ff28f0bd2279f19..6d85adbbad6ede3a89a26b54c3bad3e921816591 100644 (file)
--- a/queue-4.19/series
+++ b/queue-4.19/series
@@ -74,3 +74,4 @@ usb-dwc3-fix-phy-disable-sequence.patch
 usb-serial-ch341-fix-lost-character-on-lcr-updates.patch
 usb-serial-ch341-fix-disabled-rx-timer-on-older-devices.patch
 usb-dwc3-qcom-fix-use-after-free-on-runtime-pm-wakeup.patch
+x86-nospec-fix-i386-rsb-stuffing.patch

diff --git a/queue-4.19/x86-nospec-fix-i386-rsb-stuffing.patch b/queue-4.19/x86-nospec-fix-i386-rsb-stuffing.patch
new file mode 100644 (file)
index 0000000..dbda318
--- /dev/null
+++ b/queue-4.19/x86-nospec-fix-i386-rsb-stuffing.patch
@@ -0,0 +1,56 @@
+From foo@baz Sun Sep 11 07:48:00 AM CEST 2022
+From: Peter Zijlstra <peterz@infradead.org>
+Date: Fri, 19 Aug 2022 13:01:35 +0200
+Subject: x86/nospec: Fix i386 RSB stuffing
+
+From: Peter Zijlstra <peterz@infradead.org>
+
+commit 332924973725e8cdcc783c175f68cf7e162cb9e5 upstream.
+
+Turns out that i386 doesn't unconditionally have LFENCE, as such the
+loop in __FILL_RETURN_BUFFER isn't actually speculation safe on such
+chips.
+
+Fixes: ba6e31af2be9 ("x86/speculation: Add LFENCE to RSB fill sequence")
+Reported-by: Ben Hutchings <ben@decadent.org.uk>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Link: https://lkml.kernel.org/r/Yv9tj9vbQ9nNlXoY@worktop.programming.kicks-ass.net
+[bwh: Backported to 4.19/5.4:
+ - __FILL_RETURN_BUFFER takes an sp parameter
+ - Open-code __FILL_RETURN_SLOT]
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/x86/include/asm/nospec-branch.h |   14 ++++++++++++++
+ 1 file changed, 14 insertions(+)
+
+--- a/arch/x86/include/asm/nospec-branch.h
++++ b/arch/x86/include/asm/nospec-branch.h
+@@ -35,6 +35,7 @@
+  * the optimal version — two calls, each with their own speculation
+  * trap should their return address end up getting used, in a loop.
+  */
++#ifdef CONFIG_X86_64
+ #define __FILL_RETURN_BUFFER(reg, nr, sp)     \
+       mov     $(nr/2), reg;                   \
+ 771:                                          \
+@@ -55,6 +56,19 @@
+       add     $(BITS_PER_LONG/8) * nr, sp;    \
+       /* barrier for jnz misprediction */     \
+       lfence;
++#else
++/*
++ * i386 doesn't unconditionally have LFENCE, as such it can't
++ * do a loop.
++ */
++#define __FILL_RETURN_BUFFER(reg, nr, sp)     \
++      .rept nr;                               \
++      call    772f;                           \
++      int3;                                   \
++772:;                                         \
++      .endr;                                  \
++      add     $(BITS_PER_LONG/8) * nr, sp;
++#endif
+ 
+ /* Sequence to mitigate PBRSB on eIBRS CPUs */
+ #define __ISSUE_UNBALANCED_RET_GUARD(sp)      \