drop slub patch from 4.14 and 4.19

diff --git a/queue-4.14/series b/queue-4.14/series
index e9268836abd5dc333c3c224381c7ae6b1de3b812..bb38f002887c112db84b06c7786e011a6493e4f9 100644 (file)
--- a/queue-4.14/series
+++ b/queue-4.14/series
@@ -27,5 +27,4 @@ block-bfq-fix-use-after-free-in-bfq_idle_slice_timer.patch
 btrfs-remove-a-bug_on-from-merge_reloc_roots.patch
 btrfs-track-reloc-roots-based-on-their-commit-root-b.patch
 uapi-rename-ext2_swab-to-swab-and-share-globally-in-.patch
-slub-improve-bit-diffusion-for-freelist-ptr-obfuscat.patch
 misc-rtsx-set-correct-pcr_ops-for-rts522a.patch

diff --git a/queue-4.14/slub-improve-bit-diffusion-for-freelist-ptr-obfuscat.patch b/queue-4.14/slub-improve-bit-diffusion-for-freelist-ptr-obfuscat.patch
deleted file mode 100644 (file)
index e22d4af..0000000
--- a/queue-4.14/slub-improve-bit-diffusion-for-freelist-ptr-obfuscat.patch
+++ /dev/null
@@ -1,73 +0,0 @@
-From 7719f81048b8b169b15711142fb906324a5893db Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Wed, 1 Apr 2020 21:04:23 -0700
-Subject: slub: improve bit diffusion for freelist ptr obfuscation
-
-From: Kees Cook <keescook@chromium.org>
-
-[ Upstream commit 1ad53d9fa3f6168ebcf48a50e08b170432da2257 ]
-
-Under CONFIG_SLAB_FREELIST_HARDENED=y, the obfuscation was relatively weak
-in that the ptr and ptr address were usually so close that the first XOR
-would result in an almost entirely 0-byte value[1], leaving most of the
-"secret" number ultimately being stored after the third XOR.  A single
-blind memory content exposure of the freelist was generally sufficient to
-learn the secret.
-
-Add a swab() call to mix bits a little more.  This is a cheap way (1
-cycle) to make attacks need more than a single exposure to learn the
-secret (or to know _where_ the exposure is in memory).
-
-kmalloc-32 freelist walk, before:
-
-ptr              ptr_addr            stored value      secret
-ffff90c22e019020@ffff90c22e019000 is 86528eb656b3b5bd (86528eb656b3b59d)
-ffff90c22e019040@ffff90c22e019020 is 86528eb656b3b5fd (86528eb656b3b59d)
-ffff90c22e019060@ffff90c22e019040 is 86528eb656b3b5bd (86528eb656b3b59d)
-ffff90c22e019080@ffff90c22e019060 is 86528eb656b3b57d (86528eb656b3b59d)
-ffff90c22e0190a0@ffff90c22e019080 is 86528eb656b3b5bd (86528eb656b3b59d)
-...
-
-after:
-
-ptr              ptr_addr            stored value      secret
-ffff9eed6e019020@ffff9eed6e019000 is 793d1135d52cda42 (86528eb656b3b59d)
-ffff9eed6e019040@ffff9eed6e019020 is 593d1135d52cda22 (86528eb656b3b59d)
-ffff9eed6e019060@ffff9eed6e019040 is 393d1135d52cda02 (86528eb656b3b59d)
-ffff9eed6e019080@ffff9eed6e019060 is 193d1135d52cdae2 (86528eb656b3b59d)
-ffff9eed6e0190a0@ffff9eed6e019080 is f93d1135d52cdac2 (86528eb656b3b59d)
-
-[1] https://blog.infosectcbr.com.au/2020/03/weaknesses-in-linux-kernel-heap.html
-
-Fixes: 2482ddec670f ("mm: add SLUB free list pointer obfuscation")
-Reported-by: Silvio Cesare <silvio.cesare@gmail.com>
-Signed-off-by: Kees Cook <keescook@chromium.org>
-Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
-Cc: Christoph Lameter <cl@linux.com>
-Cc: Pekka Enberg <penberg@kernel.org>
-Cc: David Rientjes <rientjes@google.com>
-Cc: Joonsoo Kim <iamjoonsoo.kim@lge.com>
-Cc: <stable@vger.kernel.org>
-Link: http://lkml.kernel.org/r/202003051623.AF4F8CB@keescook
-Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- mm/slub.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/mm/slub.c b/mm/slub.c
-index 958a8f7a3c253..d2db6bc5e788b 100644
---- a/mm/slub.c
-+++ b/mm/slub.c
-@@ -248,7 +248,7 @@ static inline void *freelist_ptr(const struct kmem_cache *s, void *ptr,
-                                unsigned long ptr_addr)
- {
- #ifdef CONFIG_SLAB_FREELIST_HARDENED
--      return (void *)((unsigned long)ptr ^ s->random ^ ptr_addr);
-+      return (void *)swab((unsigned long)ptr ^ s->random ^ ptr_addr);
- #else
-       return ptr;
- #endif
--- 
-2.20.1
-

diff --git a/queue-4.19/series b/queue-4.19/series
index 2109cf79dd12dc64ff1afc3a8f1a9a700cd33fb6..511d297d86335b4f0e0f9e392a76004677e734e9 100644 (file)
--- a/queue-4.19/series
+++ b/queue-4.19/series
@@ -40,4 +40,3 @@ btrfs-remove-a-bug_on-from-merge_reloc_roots.patch
 btrfs-track-reloc-roots-based-on-their-commit-root-b.patch
 ib-mlx5-replace-tunnel-mpls-capability-bits-for-tunn.patch
 uapi-rename-ext2_swab-to-swab-and-share-globally-in-.patch
-slub-improve-bit-diffusion-for-freelist-ptr-obfuscat.patch

diff --git a/queue-4.19/slub-improve-bit-diffusion-for-freelist-ptr-obfuscat.patch b/queue-4.19/slub-improve-bit-diffusion-for-freelist-ptr-obfuscat.patch
deleted file mode 100644 (file)
index 140cb8a..0000000
--- a/queue-4.19/slub-improve-bit-diffusion-for-freelist-ptr-obfuscat.patch
+++ /dev/null
@@ -1,73 +0,0 @@
-From cc7031c39518a3889809759712f6cee8032e4250 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Wed, 1 Apr 2020 21:04:23 -0700
-Subject: slub: improve bit diffusion for freelist ptr obfuscation
-
-From: Kees Cook <keescook@chromium.org>
-
-[ Upstream commit 1ad53d9fa3f6168ebcf48a50e08b170432da2257 ]
-
-Under CONFIG_SLAB_FREELIST_HARDENED=y, the obfuscation was relatively weak
-in that the ptr and ptr address were usually so close that the first XOR
-would result in an almost entirely 0-byte value[1], leaving most of the
-"secret" number ultimately being stored after the third XOR.  A single
-blind memory content exposure of the freelist was generally sufficient to
-learn the secret.
-
-Add a swab() call to mix bits a little more.  This is a cheap way (1
-cycle) to make attacks need more than a single exposure to learn the
-secret (or to know _where_ the exposure is in memory).
-
-kmalloc-32 freelist walk, before:
-
-ptr              ptr_addr            stored value      secret
-ffff90c22e019020@ffff90c22e019000 is 86528eb656b3b5bd (86528eb656b3b59d)
-ffff90c22e019040@ffff90c22e019020 is 86528eb656b3b5fd (86528eb656b3b59d)
-ffff90c22e019060@ffff90c22e019040 is 86528eb656b3b5bd (86528eb656b3b59d)
-ffff90c22e019080@ffff90c22e019060 is 86528eb656b3b57d (86528eb656b3b59d)
-ffff90c22e0190a0@ffff90c22e019080 is 86528eb656b3b5bd (86528eb656b3b59d)
-...
-
-after:
-
-ptr              ptr_addr            stored value      secret
-ffff9eed6e019020@ffff9eed6e019000 is 793d1135d52cda42 (86528eb656b3b59d)
-ffff9eed6e019040@ffff9eed6e019020 is 593d1135d52cda22 (86528eb656b3b59d)
-ffff9eed6e019060@ffff9eed6e019040 is 393d1135d52cda02 (86528eb656b3b59d)
-ffff9eed6e019080@ffff9eed6e019060 is 193d1135d52cdae2 (86528eb656b3b59d)
-ffff9eed6e0190a0@ffff9eed6e019080 is f93d1135d52cdac2 (86528eb656b3b59d)
-
-[1] https://blog.infosectcbr.com.au/2020/03/weaknesses-in-linux-kernel-heap.html
-
-Fixes: 2482ddec670f ("mm: add SLUB free list pointer obfuscation")
-Reported-by: Silvio Cesare <silvio.cesare@gmail.com>
-Signed-off-by: Kees Cook <keescook@chromium.org>
-Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
-Cc: Christoph Lameter <cl@linux.com>
-Cc: Pekka Enberg <penberg@kernel.org>
-Cc: David Rientjes <rientjes@google.com>
-Cc: Joonsoo Kim <iamjoonsoo.kim@lge.com>
-Cc: <stable@vger.kernel.org>
-Link: http://lkml.kernel.org/r/202003051623.AF4F8CB@keescook
-Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- mm/slub.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/mm/slub.c b/mm/slub.c
-index 9b7b989273d41..11e5615649ee9 100644
---- a/mm/slub.c
-+++ b/mm/slub.c
-@@ -249,7 +249,7 @@ static inline void *freelist_ptr(const struct kmem_cache *s, void *ptr,
-                                unsigned long ptr_addr)
- {
- #ifdef CONFIG_SLAB_FREELIST_HARDENED
--      return (void *)((unsigned long)ptr ^ s->random ^ ptr_addr);
-+      return (void *)swab((unsigned long)ptr ^ s->random ^ ptr_addr);
- #else
-       return ptr;
- #endif
--- 
-2.20.1
-