From: Greg Kroah-Hartman Date: Mon, 16 Oct 2023 07:49:45 +0000 (+0200) Subject: 4.19-stable patches X-Git-Tag: v5.15.136~22 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=be77f4618e2addf02b11c5f386b36d0128099996;p=thirdparty%2Fkernel%2Fstable-queue.git 4.19-stable patches added patches: x86-alternatives-disable-kasan-in-apply_alternatives.patch x86-cpu-fix-amd-erratum-1485-on-zen4-based-cpus.patch --- diff --git a/queue-4.19/series b/queue-4.19/series index c77ed10cf84..47c0088e7d3 100644 --- a/queue-4.19/series +++ b/queue-4.19/series @@ -34,6 +34,8 @@ input-psmouse-fix-fast_reconnect-function-for-ps-2-mode.patch input-xpad-add-pxn-v900-support.patch cgroup-remove-duplicates-in-cgroup-v1-tasks-file.patch pinctrl-avoid-unsafe-code-pattern-in-find_pinctrl.patch +x86-cpu-fix-amd-erratum-1485-on-zen4-based-cpus.patch usb-gadget-udc-xilinx-replace-memcpy-with-memcpy_toio.patch usb-gadget-ncm-handle-decoding-of-multiple-ntb-s-in-unwrap-call.patch powerpc-64e-fix-wrong-test-in-__ptep_test_and_clear_.patch +x86-alternatives-disable-kasan-in-apply_alternatives.patch diff --git a/queue-4.19/x86-alternatives-disable-kasan-in-apply_alternatives.patch b/queue-4.19/x86-alternatives-disable-kasan-in-apply_alternatives.patch new file mode 100644 index 00000000000..4c923822250 --- /dev/null +++ b/queue-4.19/x86-alternatives-disable-kasan-in-apply_alternatives.patch @@ -0,0 +1,77 @@ +From d35652a5fc9944784f6f50a5c979518ff8dacf61 Mon Sep 17 00:00:00 2001 +From: "Kirill A. Shutemov" +Date: Thu, 12 Oct 2023 13:04:24 +0300 +Subject: x86/alternatives: Disable KASAN in apply_alternatives() + +From: Kirill A. Shutemov + +commit d35652a5fc9944784f6f50a5c979518ff8dacf61 upstream. + +Fei has reported that KASAN triggers during apply_alternatives() on +a 5-level paging machine: + + BUG: KASAN: out-of-bounds in rcu_is_watching() + Read of size 4 at addr ff110003ee6419a0 by task swapper/0/0 + ... + __asan_load4() + rcu_is_watching() + trace_hardirqs_on() + text_poke_early() + apply_alternatives() + ... + +On machines with 5-level paging, cpu_feature_enabled(X86_FEATURE_LA57) +gets patched. It includes KASAN code, where KASAN_SHADOW_START depends on +__VIRTUAL_MASK_SHIFT, which is defined with cpu_feature_enabled(). + +KASAN gets confused when apply_alternatives() patches the +KASAN_SHADOW_START users. A test patch that makes KASAN_SHADOW_START +static, by replacing __VIRTUAL_MASK_SHIFT with 56, works around the issue. + +Fix it for real by disabling KASAN while the kernel is patching alternatives. + +[ mingo: updated the changelog ] + +Fixes: 6657fca06e3f ("x86/mm: Allow to boot without LA57 if CONFIG_X86_5LEVEL=y") +Reported-by: Fei Yang +Signed-off-by: Kirill A. Shutemov +Signed-off-by: Ingo Molnar +Acked-by: Peter Zijlstra (Intel) +Cc: Linus Torvalds +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/20231012100424.1456-1-kirill.shutemov@linux.intel.com +Signed-off-by: Kirill A. Shutemov +Signed-off-by: Greg Kroah-Hartman +--- + arch/x86/kernel/alternative.c | 13 +++++++++++++ + 1 file changed, 13 insertions(+) + +--- a/arch/x86/kernel/alternative.c ++++ b/arch/x86/kernel/alternative.c +@@ -366,6 +366,17 @@ void __init_or_module noinline apply_alt + u8 insnbuf[MAX_PATCH_LEN]; + + DPRINTK("alt table %px, -> %px", start, end); ++ ++ /* ++ * In the case CONFIG_X86_5LEVEL=y, KASAN_SHADOW_START is defined using ++ * cpu_feature_enabled(X86_FEATURE_LA57) and is therefore patched here. ++ * During the process, KASAN becomes confused seeing partial LA57 ++ * conversion and triggers a false-positive out-of-bound report. ++ * ++ * Disable KASAN until the patching is complete. ++ */ ++ kasan_disable_current(); ++ + /* + * The scan order should be from start to end. A later scanned + * alternative code can overwrite previously scanned alternative code. +@@ -426,6 +437,8 @@ void __init_or_module noinline apply_alt + + text_poke_early(instr, insnbuf, insnbuf_sz); + } ++ ++ kasan_enable_current(); + } + + #ifdef CONFIG_SMP diff --git a/queue-4.19/x86-cpu-fix-amd-erratum-1485-on-zen4-based-cpus.patch b/queue-4.19/x86-cpu-fix-amd-erratum-1485-on-zen4-based-cpus.patch new file mode 100644 index 00000000000..1f7b8941943 --- /dev/null +++ b/queue-4.19/x86-cpu-fix-amd-erratum-1485-on-zen4-based-cpus.patch @@ -0,0 +1,63 @@ +From f454b18e07f518bcd0c05af17a2239138bff52de Mon Sep 17 00:00:00 2001 +From: "Borislav Petkov (AMD)" +Date: Sat, 7 Oct 2023 12:57:02 +0200 +Subject: x86/cpu: Fix AMD erratum #1485 on Zen4-based CPUs +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Borislav Petkov (AMD) + +commit f454b18e07f518bcd0c05af17a2239138bff52de upstream. + +Fix erratum #1485 on Zen4 parts where running with STIBP disabled can +cause an #UD exception. The performance impact of the fix is negligible. + +Reported-by: René Rebe +Signed-off-by: Borislav Petkov (AMD) +Tested-by: René Rebe +Cc: +Link: https://lore.kernel.org/r/D99589F4-BC5D-430B-87B2-72C20370CF57@exactcode.com +Signed-off-by: Greg Kroah-Hartman +--- + arch/x86/include/asm/msr-index.h | 4 ++++ + arch/x86/kernel/cpu/amd.c | 8 ++++++++ + 2 files changed, 12 insertions(+) + +--- a/arch/x86/include/asm/msr-index.h ++++ b/arch/x86/include/asm/msr-index.h +@@ -446,6 +446,10 @@ + + #define MSR_AMD64_VIRT_SPEC_CTRL 0xc001011f + ++/* Zen4 */ ++#define MSR_ZEN4_BP_CFG 0xc001102e ++#define MSR_ZEN4_BP_CFG_SHARED_BTB_FIX_BIT 5 ++ + /* Fam 17h MSRs */ + #define MSR_F17H_IRPERF 0xc00000e9 + +--- a/arch/x86/kernel/cpu/amd.c ++++ b/arch/x86/kernel/cpu/amd.c +@@ -72,6 +72,10 @@ static const int amd_zenbleed[] = + AMD_MODEL_RANGE(0x17, 0x90, 0x0, 0x91, 0xf), + AMD_MODEL_RANGE(0x17, 0xa0, 0x0, 0xaf, 0xf)); + ++static const int amd_erratum_1485[] = ++ AMD_LEGACY_ERRATUM(AMD_MODEL_RANGE(0x19, 0x10, 0x0, 0x1f, 0xf), ++ AMD_MODEL_RANGE(0x19, 0x60, 0x0, 0xaf, 0xf)); ++ + static bool cpu_has_amd_erratum(struct cpuinfo_x86 *cpu, const int *erratum) + { + int osvw_id = *erratum++; +@@ -1122,6 +1126,10 @@ static void init_amd(struct cpuinfo_x86 + check_null_seg_clears_base(c); + + zenbleed_check(c); ++ ++ if (!cpu_has(c, X86_FEATURE_HYPERVISOR) && ++ cpu_has_amd_erratum(c, amd_erratum_1485)) ++ msr_set_bit(MSR_ZEN4_BP_CFG, MSR_ZEN4_BP_CFG_SHARED_BTB_FIX_BIT); + } + + #ifdef CONFIG_X86_32