From: Greg Kroah-Hartman Date: Sun, 11 Sep 2022 05:48:24 +0000 (+0200) Subject: 4.19-stable patches X-Git-Tag: v5.19.9~31 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=16a83c480efe661ab460767c17d37d305f0d185f;p=thirdparty%2Fkernel%2Fstable-queue.git 4.19-stable patches added patches: x86-nospec-fix-i386-rsb-stuffing.patch --- diff --git a/queue-4.19/series b/queue-4.19/series index e776491f046..6d85adbbad6 100644 --- a/queue-4.19/series +++ b/queue-4.19/series @@ -74,3 +74,4 @@ usb-dwc3-fix-phy-disable-sequence.patch usb-serial-ch341-fix-lost-character-on-lcr-updates.patch usb-serial-ch341-fix-disabled-rx-timer-on-older-devices.patch usb-dwc3-qcom-fix-use-after-free-on-runtime-pm-wakeup.patch +x86-nospec-fix-i386-rsb-stuffing.patch diff --git a/queue-4.19/x86-nospec-fix-i386-rsb-stuffing.patch b/queue-4.19/x86-nospec-fix-i386-rsb-stuffing.patch new file mode 100644 index 00000000000..dbda318da55 --- /dev/null +++ b/queue-4.19/x86-nospec-fix-i386-rsb-stuffing.patch @@ -0,0 +1,56 @@ +From foo@baz Sun Sep 11 07:48:00 AM CEST 2022 +From: Peter Zijlstra +Date: Fri, 19 Aug 2022 13:01:35 +0200 +Subject: x86/nospec: Fix i386 RSB stuffing + +From: Peter Zijlstra + +commit 332924973725e8cdcc783c175f68cf7e162cb9e5 upstream. + +Turns out that i386 doesn't unconditionally have LFENCE, as such the +loop in __FILL_RETURN_BUFFER isn't actually speculation safe on such +chips. + +Fixes: ba6e31af2be9 ("x86/speculation: Add LFENCE to RSB fill sequence") +Reported-by: Ben Hutchings +Signed-off-by: Peter Zijlstra (Intel) +Link: https://lkml.kernel.org/r/Yv9tj9vbQ9nNlXoY@worktop.programming.kicks-ass.net +[bwh: Backported to 4.19/5.4: + - __FILL_RETURN_BUFFER takes an sp parameter + - Open-code __FILL_RETURN_SLOT] +Signed-off-by: Ben Hutchings +Signed-off-by: Greg Kroah-Hartman +--- + arch/x86/include/asm/nospec-branch.h | 14 ++++++++++++++ + 1 file changed, 14 insertions(+) + +--- a/arch/x86/include/asm/nospec-branch.h ++++ b/arch/x86/include/asm/nospec-branch.h +@@ -35,6 +35,7 @@ + * the optimal version — two calls, each with their own speculation + * trap should their return address end up getting used, in a loop. + */ ++#ifdef CONFIG_X86_64 + #define __FILL_RETURN_BUFFER(reg, nr, sp) \ + mov $(nr/2), reg; \ + 771: \ +@@ -55,6 +56,19 @@ + add $(BITS_PER_LONG/8) * nr, sp; \ + /* barrier for jnz misprediction */ \ + lfence; ++#else ++/* ++ * i386 doesn't unconditionally have LFENCE, as such it can't ++ * do a loop. ++ */ ++#define __FILL_RETURN_BUFFER(reg, nr, sp) \ ++ .rept nr; \ ++ call 772f; \ ++ int3; \ ++772:; \ ++ .endr; \ ++ add $(BITS_PER_LONG/8) * nr, sp; ++#endif + + /* Sequence to mitigate PBRSB on eIBRS CPUs */ + #define __ISSUE_UNBALANCED_RET_GUARD(sp) \