From: Greg Kroah-Hartman Date: Mon, 30 Nov 2020 08:35:20 +0000 (+0100) Subject: 4.4-stable patches X-Git-Tag: v4.4.247~15 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=d34c1d7af268ae77b3132da560ab300374bf74b9;p=thirdparty%2Fkernel%2Fstable-queue.git 4.4-stable patches added patches: usb-core-change-pk-for-__user-pointers-to-px.patch x86-speculation-fix-prctl-when-spectre_v2_user-seccomp-prctl-ibpb.patch --- diff --git a/queue-4.4/series b/queue-4.4/series index 531ccd41db7..0c5d4177af8 100644 --- a/queue-4.4/series +++ b/queue-4.4/series @@ -18,3 +18,5 @@ ib-mthca-fix-return-value-of-error-branch-in-mthca_i.patch nfc-s3fwrn5-use-signed-integer-for-parsing-gpio-numb.patch efivarfs-revert-fix-memory-leak-in-efivarfs_create.patch perf-probe-fix-to-die_entrypc-returns-error-correctl.patch +usb-core-change-pk-for-__user-pointers-to-px.patch +x86-speculation-fix-prctl-when-spectre_v2_user-seccomp-prctl-ibpb.patch diff --git a/queue-4.4/usb-core-change-pk-for-__user-pointers-to-px.patch b/queue-4.4/usb-core-change-pk-for-__user-pointers-to-px.patch new file mode 100644 index 00000000000..173d2ef8b46 --- /dev/null +++ b/queue-4.4/usb-core-change-pk-for-__user-pointers-to-px.patch @@ -0,0 +1,48 @@ +From f3bc432aa8a7a2bfe9ebb432502be5c5d979d7fe Mon Sep 17 00:00:00 2001 +From: Alan Stern +Date: Thu, 19 Nov 2020 12:02:28 -0500 +Subject: USB: core: Change %pK for __user pointers to %px + +From: Alan Stern + +commit f3bc432aa8a7a2bfe9ebb432502be5c5d979d7fe upstream. + +Commit 2f964780c03b ("USB: core: replace %p with %pK") used the %pK +format specifier for a bunch of __user pointers. But as the 'K' in +the specifier indicates, it is meant for kernel pointers. The reason +for the %pK specifier is to avoid leaks of kernel addresses, but when +the pointer is to an address in userspace the security implications +are minimal. In particular, no kernel information is leaked. + +This patch changes the __user %pK specifiers (used in a bunch of +debugging output lines) to %px, which will always print the actual +address with no mangling. (Notably, there is no printk format +specifier particularly intended for __user pointers.) + +Fixes: 2f964780c03b ("USB: core: replace %p with %pK") +CC: Vamsi Krishna Samavedam +CC: +Signed-off-by: Alan Stern +Link: https://lore.kernel.org/r/20201119170228.GB576844@rowland.harvard.edu +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/core/devio.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/usb/core/devio.c ++++ b/drivers/usb/core/devio.c +@@ -369,11 +369,11 @@ static void snoop_urb(struct usb_device + + if (userurb) { /* Async */ + if (when == SUBMIT) +- dev_info(&udev->dev, "userurb %pK, ep%d %s-%s, " ++ dev_info(&udev->dev, "userurb %px, ep%d %s-%s, " + "length %u\n", + userurb, ep, t, d, length); + else +- dev_info(&udev->dev, "userurb %pK, ep%d %s-%s, " ++ dev_info(&udev->dev, "userurb %px, ep%d %s-%s, " + "actual_length %u status %d\n", + userurb, ep, t, d, length, + timeout_or_status); diff --git a/queue-4.4/x86-speculation-fix-prctl-when-spectre_v2_user-seccomp-prctl-ibpb.patch b/queue-4.4/x86-speculation-fix-prctl-when-spectre_v2_user-seccomp-prctl-ibpb.patch new file mode 100644 index 00000000000..c6661bedb31 --- /dev/null +++ b/queue-4.4/x86-speculation-fix-prctl-when-spectre_v2_user-seccomp-prctl-ibpb.patch @@ -0,0 +1,77 @@ +From 33fc379df76b4991e5ae312f07bcd6820811971e Mon Sep 17 00:00:00 2001 +From: Anand K Mistry +Date: Tue, 10 Nov 2020 12:33:53 +1100 +Subject: x86/speculation: Fix prctl() when spectre_v2_user={seccomp,prctl},ibpb + +From: Anand K Mistry + +commit 33fc379df76b4991e5ae312f07bcd6820811971e upstream. + +When spectre_v2_user={seccomp,prctl},ibpb is specified on the command +line, IBPB is force-enabled and STIPB is conditionally-enabled (or not +available). + +However, since + + 21998a351512 ("x86/speculation: Avoid force-disabling IBPB based on STIBP and enhanced IBRS.") + +the spectre_v2_user_ibpb variable is set to SPECTRE_V2_USER_{PRCTL,SECCOMP} +instead of SPECTRE_V2_USER_STRICT, which is the actual behaviour. +Because the issuing of IBPB relies on the switch_mm_*_ibpb static +branches, the mitigations behave as expected. + +Since + + 1978b3a53a74 ("x86/speculation: Allow IBPB to be conditionally enabled on CPUs with always-on STIBP") + +this discrepency caused the misreporting of IB speculation via prctl(). + +On CPUs with STIBP always-on and spectre_v2_user=seccomp,ibpb, +prctl(PR_GET_SPECULATION_CTRL) would return PR_SPEC_PRCTL | +PR_SPEC_ENABLE instead of PR_SPEC_DISABLE since both IBPB and STIPB are +always on. It also allowed prctl(PR_SET_SPECULATION_CTRL) to set the IB +speculation mode, even though the flag is ignored. + +Similarly, for CPUs without SMT, prctl(PR_GET_SPECULATION_CTRL) should +also return PR_SPEC_DISABLE since IBPB is always on and STIBP is not +available. + + [ bp: Massage commit message. ] + +Fixes: 21998a351512 ("x86/speculation: Avoid force-disabling IBPB based on STIBP and enhanced IBRS.") +Fixes: 1978b3a53a74 ("x86/speculation: Allow IBPB to be conditionally enabled on CPUs with always-on STIBP") +Signed-off-by: Anand K Mistry +Signed-off-by: Borislav Petkov +Cc: +Link: https://lkml.kernel.org/r/20201110123349.1.Id0cbf996d2151f4c143c90f9028651a5b49a5908@changeid +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/kernel/cpu/bugs.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/arch/x86/kernel/cpu/bugs.c ++++ b/arch/x86/kernel/cpu/bugs.c +@@ -707,11 +707,13 @@ spectre_v2_user_select_mitigation(enum s + if (boot_cpu_has(X86_FEATURE_IBPB)) { + setup_force_cpu_cap(X86_FEATURE_USE_IBPB); + ++ spectre_v2_user_ibpb = mode; + switch (cmd) { + case SPECTRE_V2_USER_CMD_FORCE: + case SPECTRE_V2_USER_CMD_PRCTL_IBPB: + case SPECTRE_V2_USER_CMD_SECCOMP_IBPB: + static_branch_enable(&switch_mm_always_ibpb); ++ spectre_v2_user_ibpb = SPECTRE_V2_USER_STRICT; + break; + case SPECTRE_V2_USER_CMD_PRCTL: + case SPECTRE_V2_USER_CMD_AUTO: +@@ -725,8 +727,6 @@ spectre_v2_user_select_mitigation(enum s + pr_info("mitigation: Enabling %s Indirect Branch Prediction Barrier\n", + static_key_enabled(&switch_mm_always_ibpb) ? + "always-on" : "conditional"); +- +- spectre_v2_user_ibpb = mode; + } + + /*