4.4-stable patches

added patches:
	usb-core-change-pk-for-__user-pointers-to-px.patch
	x86-speculation-fix-prctl-when-spectre_v2_user-seccomp-prctl-ibpb.patch

diff --git a/queue-4.4/series b/queue-4.4/series
index 531ccd41db77dddee44cdaa708ac20f13e2f809e..0c5d4177af819f883bd346e79a3cd2f10a692216 100644 (file)
--- a/queue-4.4/series
+++ b/queue-4.4/series
@@ -18,3 +18,5 @@ ib-mthca-fix-return-value-of-error-branch-in-mthca_i.patch
 nfc-s3fwrn5-use-signed-integer-for-parsing-gpio-numb.patch
 efivarfs-revert-fix-memory-leak-in-efivarfs_create.patch
 perf-probe-fix-to-die_entrypc-returns-error-correctl.patch
+usb-core-change-pk-for-__user-pointers-to-px.patch
+x86-speculation-fix-prctl-when-spectre_v2_user-seccomp-prctl-ibpb.patch

diff --git a/queue-4.4/usb-core-change-pk-for-__user-pointers-to-px.patch b/queue-4.4/usb-core-change-pk-for-__user-pointers-to-px.patch
new file mode 100644 (file)
index 0000000..173d2ef
--- /dev/null
+++ b/queue-4.4/usb-core-change-pk-for-__user-pointers-to-px.patch
@@ -0,0 +1,48 @@
+From f3bc432aa8a7a2bfe9ebb432502be5c5d979d7fe Mon Sep 17 00:00:00 2001
+From: Alan Stern <stern@rowland.harvard.edu>
+Date: Thu, 19 Nov 2020 12:02:28 -0500
+Subject: USB: core: Change %pK for __user pointers to %px
+
+From: Alan Stern <stern@rowland.harvard.edu>
+
+commit f3bc432aa8a7a2bfe9ebb432502be5c5d979d7fe upstream.
+
+Commit 2f964780c03b ("USB: core: replace %p with %pK") used the %pK
+format specifier for a bunch of __user pointers.  But as the 'K' in
+the specifier indicates, it is meant for kernel pointers.  The reason
+for the %pK specifier is to avoid leaks of kernel addresses, but when
+the pointer is to an address in userspace the security implications
+are minimal.  In particular, no kernel information is leaked.
+
+This patch changes the __user %pK specifiers (used in a bunch of
+debugging output lines) to %px, which will always print the actual
+address with no mangling.  (Notably, there is no printk format
+specifier particularly intended for __user pointers.)
+
+Fixes: 2f964780c03b ("USB: core: replace %p with %pK")
+CC: Vamsi Krishna Samavedam <vskrishn@codeaurora.org>
+CC: <stable@vger.kernel.org>
+Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
+Link: https://lore.kernel.org/r/20201119170228.GB576844@rowland.harvard.edu
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/core/devio.c |    4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/usb/core/devio.c
++++ b/drivers/usb/core/devio.c
+@@ -369,11 +369,11 @@ static void snoop_urb(struct usb_device
+ 
+       if (userurb) {          /* Async */
+               if (when == SUBMIT)
+-                      dev_info(&udev->dev, "userurb %pK, ep%d %s-%s, "
++                      dev_info(&udev->dev, "userurb %px, ep%d %s-%s, "
+                                       "length %u\n",
+                                       userurb, ep, t, d, length);
+               else
+-                      dev_info(&udev->dev, "userurb %pK, ep%d %s-%s, "
++                      dev_info(&udev->dev, "userurb %px, ep%d %s-%s, "
+                                       "actual_length %u status %d\n",
+                                       userurb, ep, t, d, length,
+                                       timeout_or_status);

diff --git a/queue-4.4/x86-speculation-fix-prctl-when-spectre_v2_user-seccomp-prctl-ibpb.patch b/queue-4.4/x86-speculation-fix-prctl-when-spectre_v2_user-seccomp-prctl-ibpb.patch
new file mode 100644 (file)
index 0000000..c6661be
--- /dev/null
+++ b/queue-4.4/x86-speculation-fix-prctl-when-spectre_v2_user-seccomp-prctl-ibpb.patch
@@ -0,0 +1,77 @@
+From 33fc379df76b4991e5ae312f07bcd6820811971e Mon Sep 17 00:00:00 2001
+From: Anand K Mistry <amistry@google.com>
+Date: Tue, 10 Nov 2020 12:33:53 +1100
+Subject: x86/speculation: Fix prctl() when spectre_v2_user={seccomp,prctl},ibpb
+
+From: Anand K Mistry <amistry@google.com>
+
+commit 33fc379df76b4991e5ae312f07bcd6820811971e upstream.
+
+When spectre_v2_user={seccomp,prctl},ibpb is specified on the command
+line, IBPB is force-enabled and STIPB is conditionally-enabled (or not
+available).
+
+However, since
+
+  21998a351512 ("x86/speculation: Avoid force-disabling IBPB based on STIBP and enhanced IBRS.")
+
+the spectre_v2_user_ibpb variable is set to SPECTRE_V2_USER_{PRCTL,SECCOMP}
+instead of SPECTRE_V2_USER_STRICT, which is the actual behaviour.
+Because the issuing of IBPB relies on the switch_mm_*_ibpb static
+branches, the mitigations behave as expected.
+
+Since
+
+  1978b3a53a74 ("x86/speculation: Allow IBPB to be conditionally enabled on CPUs with always-on STIBP")
+
+this discrepency caused the misreporting of IB speculation via prctl().
+
+On CPUs with STIBP always-on and spectre_v2_user=seccomp,ibpb,
+prctl(PR_GET_SPECULATION_CTRL) would return PR_SPEC_PRCTL |
+PR_SPEC_ENABLE instead of PR_SPEC_DISABLE since both IBPB and STIPB are
+always on. It also allowed prctl(PR_SET_SPECULATION_CTRL) to set the IB
+speculation mode, even though the flag is ignored.
+
+Similarly, for CPUs without SMT, prctl(PR_GET_SPECULATION_CTRL) should
+also return PR_SPEC_DISABLE since IBPB is always on and STIBP is not
+available.
+
+ [ bp: Massage commit message. ]
+
+Fixes: 21998a351512 ("x86/speculation: Avoid force-disabling IBPB based on STIBP and enhanced IBRS.")
+Fixes: 1978b3a53a74 ("x86/speculation: Allow IBPB to be conditionally enabled on CPUs with always-on STIBP")
+Signed-off-by: Anand K Mistry <amistry@google.com>
+Signed-off-by: Borislav Petkov <bp@suse.de>
+Cc: <stable@vger.kernel.org>
+Link: https://lkml.kernel.org/r/20201110123349.1.Id0cbf996d2151f4c143c90f9028651a5b49a5908@changeid
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/x86/kernel/cpu/bugs.c |    4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/arch/x86/kernel/cpu/bugs.c
++++ b/arch/x86/kernel/cpu/bugs.c
+@@ -707,11 +707,13 @@ spectre_v2_user_select_mitigation(enum s
+       if (boot_cpu_has(X86_FEATURE_IBPB)) {
+               setup_force_cpu_cap(X86_FEATURE_USE_IBPB);
+ 
++              spectre_v2_user_ibpb = mode;
+               switch (cmd) {
+               case SPECTRE_V2_USER_CMD_FORCE:
+               case SPECTRE_V2_USER_CMD_PRCTL_IBPB:
+               case SPECTRE_V2_USER_CMD_SECCOMP_IBPB:
+                       static_branch_enable(&switch_mm_always_ibpb);
++                      spectre_v2_user_ibpb = SPECTRE_V2_USER_STRICT;
+                       break;
+               case SPECTRE_V2_USER_CMD_PRCTL:
+               case SPECTRE_V2_USER_CMD_AUTO:
+@@ -725,8 +727,6 @@ spectre_v2_user_select_mitigation(enum s
+               pr_info("mitigation: Enabling %s Indirect Branch Prediction Barrier\n",
+                       static_key_enabled(&switch_mm_always_ibpb) ?
+                       "always-on" : "conditional");
+-
+-              spectre_v2_user_ibpb = mode;
+       }
+ 
+       /*