From: Greg Kroah-Hartman Date: Thu, 15 Jul 2021 11:58:07 +0000 (+0200) Subject: 5.4-stable patches X-Git-Tag: v5.4.133~48 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=077f121c76de10fd546cfab511eb259d93919300;p=thirdparty%2Fkernel%2Fstable-queue.git 5.4-stable patches added patches: powerpc-barrier-avoid-collision-with-clang-s-__lwsync-macro.patch powerpc-mm-fix-lockup-on-kernel-exec-fault.patch --- diff --git a/queue-5.4/powerpc-barrier-avoid-collision-with-clang-s-__lwsync-macro.patch b/queue-5.4/powerpc-barrier-avoid-collision-with-clang-s-__lwsync-macro.patch new file mode 100644 index 00000000000..426e7138895 --- /dev/null +++ b/queue-5.4/powerpc-barrier-avoid-collision-with-clang-s-__lwsync-macro.patch @@ -0,0 +1,57 @@ +From 015d98149b326e0f1f02e44413112ca8b4330543 Mon Sep 17 00:00:00 2001 +From: Nathan Chancellor +Date: Fri, 28 May 2021 11:27:52 -0700 +Subject: powerpc/barrier: Avoid collision with clang's __lwsync macro + +From: Nathan Chancellor + +commit 015d98149b326e0f1f02e44413112ca8b4330543 upstream. + +A change in clang 13 results in the __lwsync macro being defined as +__builtin_ppc_lwsync, which emits 'lwsync' or 'msync' depending on what +the target supports. This breaks the build because of -Werror in +arch/powerpc, along with thousands of warnings: + + In file included from arch/powerpc/kernel/pmc.c:12: + In file included from include/linux/bug.h:5: + In file included from arch/powerpc/include/asm/bug.h:109: + In file included from include/asm-generic/bug.h:20: + In file included from include/linux/kernel.h:12: + In file included from include/linux/bitops.h:32: + In file included from arch/powerpc/include/asm/bitops.h:62: + arch/powerpc/include/asm/barrier.h:49:9: error: '__lwsync' macro redefined [-Werror,-Wmacro-redefined] + #define __lwsync() __asm__ __volatile__ (stringify_in_c(LWSYNC) : : :"memory") + ^ + :308:9: note: previous definition is here + #define __lwsync __builtin_ppc_lwsync + ^ + 1 error generated. + +Undefine this macro so that the runtime patching introduced by +commit 2d1b2027626d ("powerpc: Fixup lwsync at runtime") continues to +work properly with clang and the build no longer breaks. + +Cc: stable@vger.kernel.org +Signed-off-by: Nathan Chancellor +Reviewed-by: Nick Desaulniers +Signed-off-by: Michael Ellerman +Link: https://github.com/ClangBuiltLinux/linux/issues/1386 +Link: https://github.com/llvm/llvm-project/commit/62b5df7fe2b3fda1772befeda15598fbef96a614 +Link: https://lore.kernel.org/r/20210528182752.1852002-1-nathan@kernel.org +Signed-off-by: Greg Kroah-Hartman + +--- + arch/powerpc/include/asm/barrier.h | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/arch/powerpc/include/asm/barrier.h ++++ b/arch/powerpc/include/asm/barrier.h +@@ -44,6 +44,8 @@ + # define SMPWMB eieio + #endif + ++/* clang defines this macro for a builtin, which will not work with runtime patching */ ++#undef __lwsync + #define __lwsync() __asm__ __volatile__ (stringify_in_c(LWSYNC) : : :"memory") + #define dma_rmb() __lwsync() + #define dma_wmb() __asm__ __volatile__ (stringify_in_c(SMPWMB) : : :"memory") diff --git a/queue-5.4/powerpc-mm-fix-lockup-on-kernel-exec-fault.patch b/queue-5.4/powerpc-mm-fix-lockup-on-kernel-exec-fault.patch new file mode 100644 index 00000000000..883ce8db981 --- /dev/null +++ b/queue-5.4/powerpc-mm-fix-lockup-on-kernel-exec-fault.patch @@ -0,0 +1,67 @@ +From cd5d5e602f502895e47e18cd46804d6d7014e65c Mon Sep 17 00:00:00 2001 +From: Christophe Leroy +Date: Thu, 1 Jul 2021 11:17:08 +0000 +Subject: powerpc/mm: Fix lockup on kernel exec fault + +From: Christophe Leroy + +commit cd5d5e602f502895e47e18cd46804d6d7014e65c upstream. + +The powerpc kernel is not prepared to handle exec faults from kernel. +Especially, the function is_exec_fault() will return 'false' when an +exec fault is taken by kernel, because the check is based on reading +current->thread.regs->trap which contains the trap from user. + +For instance, when provoking a LKDTM EXEC_USERSPACE test, +current->thread.regs->trap is set to SYSCALL trap (0xc00), and +the fault taken by the kernel is not seen as an exec fault by +set_access_flags_filter(). + +Commit d7df2443cd5f ("powerpc/mm: Fix spurious segfaults on radix +with autonuma") made it clear and handled it properly. But later on +commit d3ca587404b3 ("powerpc/mm: Fix reporting of kernel execute +faults") removed that handling, introducing test based on error_code. +And here is the problem, because on the 603 all upper bits of SRR1 +get cleared when the TLB instruction miss handler bails out to ISI. + +Until commit cbd7e6ca0210 ("powerpc/fault: Avoid heavy +search_exception_tables() verification"), an exec fault from kernel +at a userspace address was indirectly caught by the lack of entry for +that address in the exception tables. But after that commit the +kernel mainly relies on KUAP or on core mm handling to catch wrong +user accesses. Here the access is not wrong, so mm handles it. +It is a minor fault because PAGE_EXEC is not set, +set_access_flags_filter() should set PAGE_EXEC and voila. +But as is_exec_fault() returns false as explained in the beginning, +set_access_flags_filter() bails out without setting PAGE_EXEC flag, +which leads to a forever minor exec fault. + +As the kernel is not prepared to handle such exec faults, the thing to +do is to fire in bad_kernel_fault() for any exec fault taken by the +kernel, as it was prior to commit d3ca587404b3. + +Fixes: d3ca587404b3 ("powerpc/mm: Fix reporting of kernel execute faults") +Cc: stable@vger.kernel.org # v4.14+ +Signed-off-by: Christophe Leroy +Acked-by: Nicholas Piggin +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/024bb05105050f704743a0083fe3548702be5706.1625138205.git.christophe.leroy@csgroup.eu +Signed-off-by: Greg Kroah-Hartman + +--- + arch/powerpc/mm/fault.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +--- a/arch/powerpc/mm/fault.c ++++ b/arch/powerpc/mm/fault.c +@@ -204,9 +204,7 @@ static bool bad_kernel_fault(struct pt_r + { + int is_exec = TRAP(regs) == 0x400; + +- /* NX faults set DSISR_PROTFAULT on the 8xx, DSISR_NOEXEC_OR_G on others */ +- if (is_exec && (error_code & (DSISR_NOEXEC_OR_G | DSISR_KEYFAULT | +- DSISR_PROTFAULT))) { ++ if (is_exec) { + pr_crit_ratelimited("kernel tried to execute %s page (%lx) - exploit attempt? (uid: %d)\n", + address >= TASK_SIZE ? "exec-protected" : "user", + address, diff --git a/queue-5.4/series b/queue-5.4/series index a5125ff00d7..cb14e4991e9 100644 --- a/queue-5.4/series +++ b/queue-5.4/series @@ -72,3 +72,5 @@ mips-set-mips32r5-for-virt-extensions.patch fscrypt-don-t-ignore-minor_hash-when-hash-is-0.patch crypto-ccp-annotate-sev-firmware-file-names.patch perf-bench-fix-2-memory-sanitizer-warnings.patch +powerpc-mm-fix-lockup-on-kernel-exec-fault.patch +powerpc-barrier-avoid-collision-with-clang-s-__lwsync-macro.patch