5.4-stable patches

added patches:
	x86-nospec-fix-i386-rsb-stuffing.patch

diff --git a/queue-5.4/series b/queue-5.4/series
index 68fd4e129d9d6fc246db298c98cfc4cfa9ad8865..7ca70e15111b5c8bd4eb6b60812f0885676e11d4 100644 (file)
--- a/queue-5.4/series
+++ b/queue-5.4/series
@@ -104,3 +104,4 @@ rdma-mlx5-set-local-port-to-one-when-accessing-count.patch
 nvme-tcp-fix-uaf-when-detecting-digest-errors.patch
 tcp-fix-early-etimedout-after-spurious-non-sack-rto.patch
 sch_sfb-also-store-skb-len-before-calling-child-enqu.patch
+x86-nospec-fix-i386-rsb-stuffing.patch

diff --git a/queue-5.4/x86-nospec-fix-i386-rsb-stuffing.patch b/queue-5.4/x86-nospec-fix-i386-rsb-stuffing.patch
new file mode 100644 (file)
index 0000000..45cac70
--- /dev/null
+++ b/queue-5.4/x86-nospec-fix-i386-rsb-stuffing.patch
@@ -0,0 +1,56 @@
+From foo@baz Sun Sep 11 07:47:57 AM CEST 2022
+From: Peter Zijlstra <peterz@infradead.org>
+Date: Fri, 19 Aug 2022 13:01:35 +0200
+Subject: x86/nospec: Fix i386 RSB stuffing
+
+From: Peter Zijlstra <peterz@infradead.org>
+
+commit 332924973725e8cdcc783c175f68cf7e162cb9e5 upstream.
+
+Turns out that i386 doesn't unconditionally have LFENCE, as such the
+loop in __FILL_RETURN_BUFFER isn't actually speculation safe on such
+chips.
+
+Fixes: ba6e31af2be9 ("x86/speculation: Add LFENCE to RSB fill sequence")
+Reported-by: Ben Hutchings <ben@decadent.org.uk>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Link: https://lkml.kernel.org/r/Yv9tj9vbQ9nNlXoY@worktop.programming.kicks-ass.net
+[bwh: Backported to 4.19/5.4:
+ - __FILL_RETURN_BUFFER takes an sp parameter
+ - Open-code __FILL_RETURN_SLOT]
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/x86/include/asm/nospec-branch.h |   14 ++++++++++++++
+ 1 file changed, 14 insertions(+)
+
+--- a/arch/x86/include/asm/nospec-branch.h
++++ b/arch/x86/include/asm/nospec-branch.h
+@@ -44,6 +44,7 @@
+  * the optimal version — two calls, each with their own speculation
+  * trap should their return address end up getting used, in a loop.
+  */
++#ifdef CONFIG_X86_64
+ #define __FILL_RETURN_BUFFER(reg, nr, sp)     \
+       mov     $(nr/2), reg;                   \
+ 771:                                          \
+@@ -64,6 +65,19 @@
+       add     $(BITS_PER_LONG/8) * nr, sp;    \
+       /* barrier for jnz misprediction */     \
+       lfence;
++#else
++/*
++ * i386 doesn't unconditionally have LFENCE, as such it can't
++ * do a loop.
++ */
++#define __FILL_RETURN_BUFFER(reg, nr, sp)     \
++      .rept nr;                               \
++      call    772f;                           \
++      int3;                                   \
++772:;                                         \
++      .endr;                                  \
++      add     $(BITS_PER_LONG/8) * nr, sp;
++#endif
+ 
+ #define __ISSUE_UNBALANCED_RET_GUARD(sp)      \
+       call    881f;                           \