5.15-stable patches

added patches:
	x86-speculation-make-all-retbleed-mitigations-64-bit-only.patch

diff --git a/queue-5.15/series b/queue-5.15/series
new file mode 100644 (file)
index 0000000..c94cb24
--- /dev/null
+++ b/queue-5.15/series
@@ -0,0 +1 @@
+x86-speculation-make-all-retbleed-mitigations-64-bit-only.patch

diff --git a/queue-5.15/x86-speculation-make-all-retbleed-mitigations-64-bit-only.patch b/queue-5.15/x86-speculation-make-all-retbleed-mitigations-64-bit-only.patch
new file mode 100644 (file)
index 0000000..4b9ae56
--- /dev/null
+++ b/queue-5.15/x86-speculation-make-all-retbleed-mitigations-64-bit-only.patch
@@ -0,0 +1,66 @@
+From b648ab487f31bc4c38941bc770ea97fe394304bb Mon Sep 17 00:00:00 2001
+From: Ben Hutchings <ben@decadent.org.uk>
+Date: Sat, 23 Jul 2022 17:22:47 +0200
+Subject: x86/speculation: Make all RETbleed mitigations 64-bit only
+
+From: Ben Hutchings <ben@decadent.org.uk>
+
+commit b648ab487f31bc4c38941bc770ea97fe394304bb upstream.
+
+The mitigations for RETBleed are currently ineffective on x86_32 since
+entry_32.S does not use the required macros.  However, for an x86_32
+target, the kconfig symbols for them are still enabled by default and
+/sys/devices/system/cpu/vulnerabilities/retbleed will wrongly report
+that mitigations are in place.
+
+Make all of these symbols depend on X86_64, and only enable RETHUNK by
+default on X86_64.
+
+Fixes: f43b9876e857 ("x86/retbleed: Add fine grained Kconfig knobs")
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+Signed-off-by: Borislav Petkov <bp@suse.de>
+Cc: <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/YtwSR3NNsWp1ohfV@decadent.org.uk
+[bwh: Backported to 5.10/5.15/5.18: adjust context]
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/x86/Kconfig |    8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/arch/x86/Kconfig
++++ b/arch/x86/Kconfig
+@@ -2427,7 +2427,7 @@ config RETPOLINE
+ config RETHUNK
+       bool "Enable return-thunks"
+       depends on RETPOLINE && CC_HAS_RETURN_THUNK
+-      default y
++      default y if X86_64
+       help
+         Compile the kernel with the return-thunks compiler option to guard
+         against kernel-to-user data leaks by avoiding return speculation.
+@@ -2436,21 +2436,21 @@ config RETHUNK
+ 
+ config CPU_UNRET_ENTRY
+       bool "Enable UNRET on kernel entry"
+-      depends on CPU_SUP_AMD && RETHUNK
++      depends on CPU_SUP_AMD && RETHUNK && X86_64
+       default y
+       help
+         Compile the kernel with support for the retbleed=unret mitigation.
+ 
+ config CPU_IBPB_ENTRY
+       bool "Enable IBPB on kernel entry"
+-      depends on CPU_SUP_AMD
++      depends on CPU_SUP_AMD && X86_64
+       default y
+       help
+         Compile the kernel with support for the retbleed=ibpb mitigation.
+ 
+ config CPU_IBRS_ENTRY
+       bool "Enable IBRS on kernel entry"
+-      depends on CPU_SUP_INTEL
++      depends on CPU_SUP_INTEL && X86_64
+       default y
+       help
+         Compile the kernel with support for the spectre_v2=ibrs mitigation.