4.4-stable patches

added patches:
	x86-fsgsbase-64-fully-initialize-fs-and-gs-state-in-start_thread_common.patch
	x86-fsgsbase-64-report-fsbase-and-gsbase-correctly-in-core-dumps.patch

diff --git a/queue-4.4/series b/queue-4.4/series
index 3af64de93f25e257a051e7c268b2d9c53cdcd671..af337b0500b67f7002c5868c1a20d84bcf60c0ba 100644 (file)
--- a/queue-4.4/series
+++ b/queue-4.4/series
@@ -10,3 +10,5 @@ gianfar-fix-tx-flow-control-deactivation.patch
 ipv6-fix-memory-leak-with-multiple-tables-during-netns-destruction.patch
 ipv6-fix-typo-in-fib6_net_exit.patch
 f2fs-check-hot_data-for-roll-forward-recovery.patch
+x86-fsgsbase-64-fully-initialize-fs-and-gs-state-in-start_thread_common.patch
+x86-fsgsbase-64-report-fsbase-and-gsbase-correctly-in-core-dumps.patch

diff --git a/queue-4.4/x86-fsgsbase-64-fully-initialize-fs-and-gs-state-in-start_thread_common.patch b/queue-4.4/x86-fsgsbase-64-fully-initialize-fs-and-gs-state-in-start_thread_common.patch
new file mode 100644 (file)
index 0000000..cee2485
--- /dev/null
+++ b/queue-4.4/x86-fsgsbase-64-fully-initialize-fs-and-gs-state-in-start_thread_common.patch
@@ -0,0 +1,58 @@
+From 767d035d838f4fd6b5a5bbd7a3f6d293b7f65a49 Mon Sep 17 00:00:00 2001
+From: Andy Lutomirski <luto@kernel.org>
+Date: Tue, 1 Aug 2017 07:11:34 -0700
+Subject: x86/fsgsbase/64: Fully initialize FS and GS state in start_thread_common
+
+From: Andy Lutomirski <luto@kernel.org>
+
+commit 767d035d838f4fd6b5a5bbd7a3f6d293b7f65a49 upstream.
+
+execve used to leak FSBASE and GSBASE on AMD CPUs.  Fix it.
+
+The security impact of this bug is small but not quite zero -- it
+could weaken ASLR when a privileged task execs a less privileged
+program, but only if program changed bitness across the exec, or the
+child binary was highly unusual or actively malicious.  A child
+program that was compromised after the exec would not have access to
+the leaked base.
+
+Signed-off-by: Andy Lutomirski <luto@kernel.org>
+Cc: Borislav Petkov <bp@alien8.de>
+Cc: Borislav Petkov <bpetkov@suse.de>
+Cc: Brian Gerst <brgerst@gmail.com>
+Cc: Chang Seok <chang.seok.bae@intel.com>
+Cc: Denys Vlasenko <dvlasenk@redhat.com>
+Cc: H. Peter Anvin <hpa@zytor.com>
+Cc: Josh Poimboeuf <jpoimboe@redhat.com>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/x86/kernel/process_64.c |    9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+--- a/arch/x86/kernel/process_64.c
++++ b/arch/x86/kernel/process_64.c
+@@ -232,10 +232,19 @@ start_thread_common(struct pt_regs *regs
+                   unsigned long new_sp,
+                   unsigned int _cs, unsigned int _ss, unsigned int _ds)
+ {
++      WARN_ON_ONCE(regs != current_pt_regs());
++
++      if (static_cpu_has(X86_BUG_NULL_SEG)) {
++              /* Loading zero below won't clear the base. */
++              loadsegment(fs, __USER_DS);
++              load_gs_index(__USER_DS);
++      }
++
+       loadsegment(fs, 0);
+       loadsegment(es, _ds);
+       loadsegment(ds, _ds);
+       load_gs_index(0);
++
+       regs->ip                = new_ip;
+       regs->sp                = new_sp;
+       regs->cs                = _cs;

diff --git a/queue-4.4/x86-fsgsbase-64-report-fsbase-and-gsbase-correctly-in-core-dumps.patch b/queue-4.4/x86-fsgsbase-64-report-fsbase-and-gsbase-correctly-in-core-dumps.patch
new file mode 100644 (file)
index 0000000..43203b8
--- /dev/null
+++ b/queue-4.4/x86-fsgsbase-64-report-fsbase-and-gsbase-correctly-in-core-dumps.patch
@@ -0,0 +1,56 @@
+From 9584d98bed7a7a904d0702ad06bbcc94703cb5b4 Mon Sep 17 00:00:00 2001
+From: Andy Lutomirski <luto@kernel.org>
+Date: Tue, 1 Aug 2017 07:11:35 -0700
+Subject: x86/fsgsbase/64: Report FSBASE and GSBASE correctly in core dumps
+
+From: Andy Lutomirski <luto@kernel.org>
+
+commit 9584d98bed7a7a904d0702ad06bbcc94703cb5b4 upstream.
+
+In ELF_COPY_CORE_REGS, we're copying from the current task, so
+accessing thread.fsbase and thread.gsbase makes no sense.  Just read
+the values from the CPU registers.
+
+In practice, the old code would have been correct most of the time
+simply because thread.fsbase and thread.gsbase usually matched the
+CPU registers.
+
+Signed-off-by: Andy Lutomirski <luto@kernel.org>
+Cc: Borislav Petkov <bp@alien8.de>
+Cc: Borislav Petkov <bpetkov@suse.de>
+Cc: Brian Gerst <brgerst@gmail.com>
+Cc: Chang Seok <chang.seok.bae@intel.com>
+Cc: Denys Vlasenko <dvlasenk@redhat.com>
+Cc: H. Peter Anvin <hpa@zytor.com>
+Cc: Josh Poimboeuf <jpoimboe@redhat.com>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/x86/include/asm/elf.h |    5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/arch/x86/include/asm/elf.h
++++ b/arch/x86/include/asm/elf.h
+@@ -204,6 +204,7 @@ void set_personality_ia32(bool);
+ 
+ #define ELF_CORE_COPY_REGS(pr_reg, regs)                      \
+ do {                                                          \
++      unsigned long base;                                     \
+       unsigned v;                                             \
+       (pr_reg)[0] = (regs)->r15;                              \
+       (pr_reg)[1] = (regs)->r14;                              \
+@@ -226,8 +227,8 @@ do {                                                               \
+       (pr_reg)[18] = (regs)->flags;                           \
+       (pr_reg)[19] = (regs)->sp;                              \
+       (pr_reg)[20] = (regs)->ss;                              \
+-      (pr_reg)[21] = current->thread.fs;                      \
+-      (pr_reg)[22] = current->thread.gs;                      \
++      rdmsrl(MSR_FS_BASE, base); (pr_reg)[21] = base;         \
++      rdmsrl(MSR_KERNEL_GS_BASE, base); (pr_reg)[22] = base;  \
+       asm("movl %%ds,%0" : "=r" (v)); (pr_reg)[23] = v;       \
+       asm("movl %%es,%0" : "=r" (v)); (pr_reg)[24] = v;       \
+       asm("movl %%fs,%0" : "=r" (v)); (pr_reg)[25] = v;       \