From eefc767e26b633fcae9a291a579c1d9f7b15bd12 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Tue, 14 Apr 2020 10:08:19 +0200 Subject: [PATCH] drop slub patch from 4.14 and 4.19 --- queue-4.14/series | 1 - ...-diffusion-for-freelist-ptr-obfuscat.patch | 73 ------------------- queue-4.19/series | 1 - ...-diffusion-for-freelist-ptr-obfuscat.patch | 73 ------------------- 4 files changed, 148 deletions(-) delete mode 100644 queue-4.14/slub-improve-bit-diffusion-for-freelist-ptr-obfuscat.patch delete mode 100644 queue-4.19/slub-improve-bit-diffusion-for-freelist-ptr-obfuscat.patch diff --git a/queue-4.14/series b/queue-4.14/series index e9268836abd..bb38f002887 100644 --- a/queue-4.14/series +++ b/queue-4.14/series @@ -27,5 +27,4 @@ block-bfq-fix-use-after-free-in-bfq_idle_slice_timer.patch btrfs-remove-a-bug_on-from-merge_reloc_roots.patch btrfs-track-reloc-roots-based-on-their-commit-root-b.patch uapi-rename-ext2_swab-to-swab-and-share-globally-in-.patch -slub-improve-bit-diffusion-for-freelist-ptr-obfuscat.patch misc-rtsx-set-correct-pcr_ops-for-rts522a.patch diff --git a/queue-4.14/slub-improve-bit-diffusion-for-freelist-ptr-obfuscat.patch b/queue-4.14/slub-improve-bit-diffusion-for-freelist-ptr-obfuscat.patch deleted file mode 100644 index e22d4af519a..00000000000 --- a/queue-4.14/slub-improve-bit-diffusion-for-freelist-ptr-obfuscat.patch +++ /dev/null @@ -1,73 +0,0 @@ -From 7719f81048b8b169b15711142fb906324a5893db Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Wed, 1 Apr 2020 21:04:23 -0700 -Subject: slub: improve bit diffusion for freelist ptr obfuscation - -From: Kees Cook - -[ Upstream commit 1ad53d9fa3f6168ebcf48a50e08b170432da2257 ] - -Under CONFIG_SLAB_FREELIST_HARDENED=y, the obfuscation was relatively weak -in that the ptr and ptr address were usually so close that the first XOR -would result in an almost entirely 0-byte value[1], leaving most of the -"secret" number ultimately being stored after the third XOR. A single -blind memory content exposure of the freelist was generally sufficient to -learn the secret. - -Add a swab() call to mix bits a little more. This is a cheap way (1 -cycle) to make attacks need more than a single exposure to learn the -secret (or to know _where_ the exposure is in memory). - -kmalloc-32 freelist walk, before: - -ptr ptr_addr stored value secret -ffff90c22e019020@ffff90c22e019000 is 86528eb656b3b5bd (86528eb656b3b59d) -ffff90c22e019040@ffff90c22e019020 is 86528eb656b3b5fd (86528eb656b3b59d) -ffff90c22e019060@ffff90c22e019040 is 86528eb656b3b5bd (86528eb656b3b59d) -ffff90c22e019080@ffff90c22e019060 is 86528eb656b3b57d (86528eb656b3b59d) -ffff90c22e0190a0@ffff90c22e019080 is 86528eb656b3b5bd (86528eb656b3b59d) -... - -after: - -ptr ptr_addr stored value secret -ffff9eed6e019020@ffff9eed6e019000 is 793d1135d52cda42 (86528eb656b3b59d) -ffff9eed6e019040@ffff9eed6e019020 is 593d1135d52cda22 (86528eb656b3b59d) -ffff9eed6e019060@ffff9eed6e019040 is 393d1135d52cda02 (86528eb656b3b59d) -ffff9eed6e019080@ffff9eed6e019060 is 193d1135d52cdae2 (86528eb656b3b59d) -ffff9eed6e0190a0@ffff9eed6e019080 is f93d1135d52cdac2 (86528eb656b3b59d) - -[1] https://blog.infosectcbr.com.au/2020/03/weaknesses-in-linux-kernel-heap.html - -Fixes: 2482ddec670f ("mm: add SLUB free list pointer obfuscation") -Reported-by: Silvio Cesare -Signed-off-by: Kees Cook -Signed-off-by: Andrew Morton -Cc: Christoph Lameter -Cc: Pekka Enberg -Cc: David Rientjes -Cc: Joonsoo Kim -Cc: -Link: http://lkml.kernel.org/r/202003051623.AF4F8CB@keescook -Signed-off-by: Linus Torvalds -Signed-off-by: Sasha Levin ---- - mm/slub.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/mm/slub.c b/mm/slub.c -index 958a8f7a3c253..d2db6bc5e788b 100644 ---- a/mm/slub.c -+++ b/mm/slub.c -@@ -248,7 +248,7 @@ static inline void *freelist_ptr(const struct kmem_cache *s, void *ptr, - unsigned long ptr_addr) - { - #ifdef CONFIG_SLAB_FREELIST_HARDENED -- return (void *)((unsigned long)ptr ^ s->random ^ ptr_addr); -+ return (void *)swab((unsigned long)ptr ^ s->random ^ ptr_addr); - #else - return ptr; - #endif --- -2.20.1 - diff --git a/queue-4.19/series b/queue-4.19/series index 2109cf79dd1..511d297d863 100644 --- a/queue-4.19/series +++ b/queue-4.19/series @@ -40,4 +40,3 @@ btrfs-remove-a-bug_on-from-merge_reloc_roots.patch btrfs-track-reloc-roots-based-on-their-commit-root-b.patch ib-mlx5-replace-tunnel-mpls-capability-bits-for-tunn.patch uapi-rename-ext2_swab-to-swab-and-share-globally-in-.patch -slub-improve-bit-diffusion-for-freelist-ptr-obfuscat.patch diff --git a/queue-4.19/slub-improve-bit-diffusion-for-freelist-ptr-obfuscat.patch b/queue-4.19/slub-improve-bit-diffusion-for-freelist-ptr-obfuscat.patch deleted file mode 100644 index 140cb8a385d..00000000000 --- a/queue-4.19/slub-improve-bit-diffusion-for-freelist-ptr-obfuscat.patch +++ /dev/null @@ -1,73 +0,0 @@ -From cc7031c39518a3889809759712f6cee8032e4250 Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Wed, 1 Apr 2020 21:04:23 -0700 -Subject: slub: improve bit diffusion for freelist ptr obfuscation - -From: Kees Cook - -[ Upstream commit 1ad53d9fa3f6168ebcf48a50e08b170432da2257 ] - -Under CONFIG_SLAB_FREELIST_HARDENED=y, the obfuscation was relatively weak -in that the ptr and ptr address were usually so close that the first XOR -would result in an almost entirely 0-byte value[1], leaving most of the -"secret" number ultimately being stored after the third XOR. A single -blind memory content exposure of the freelist was generally sufficient to -learn the secret. - -Add a swab() call to mix bits a little more. This is a cheap way (1 -cycle) to make attacks need more than a single exposure to learn the -secret (or to know _where_ the exposure is in memory). - -kmalloc-32 freelist walk, before: - -ptr ptr_addr stored value secret -ffff90c22e019020@ffff90c22e019000 is 86528eb656b3b5bd (86528eb656b3b59d) -ffff90c22e019040@ffff90c22e019020 is 86528eb656b3b5fd (86528eb656b3b59d) -ffff90c22e019060@ffff90c22e019040 is 86528eb656b3b5bd (86528eb656b3b59d) -ffff90c22e019080@ffff90c22e019060 is 86528eb656b3b57d (86528eb656b3b59d) -ffff90c22e0190a0@ffff90c22e019080 is 86528eb656b3b5bd (86528eb656b3b59d) -... - -after: - -ptr ptr_addr stored value secret -ffff9eed6e019020@ffff9eed6e019000 is 793d1135d52cda42 (86528eb656b3b59d) -ffff9eed6e019040@ffff9eed6e019020 is 593d1135d52cda22 (86528eb656b3b59d) -ffff9eed6e019060@ffff9eed6e019040 is 393d1135d52cda02 (86528eb656b3b59d) -ffff9eed6e019080@ffff9eed6e019060 is 193d1135d52cdae2 (86528eb656b3b59d) -ffff9eed6e0190a0@ffff9eed6e019080 is f93d1135d52cdac2 (86528eb656b3b59d) - -[1] https://blog.infosectcbr.com.au/2020/03/weaknesses-in-linux-kernel-heap.html - -Fixes: 2482ddec670f ("mm: add SLUB free list pointer obfuscation") -Reported-by: Silvio Cesare -Signed-off-by: Kees Cook -Signed-off-by: Andrew Morton -Cc: Christoph Lameter -Cc: Pekka Enberg -Cc: David Rientjes -Cc: Joonsoo Kim -Cc: -Link: http://lkml.kernel.org/r/202003051623.AF4F8CB@keescook -Signed-off-by: Linus Torvalds -Signed-off-by: Sasha Levin ---- - mm/slub.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/mm/slub.c b/mm/slub.c -index 9b7b989273d41..11e5615649ee9 100644 ---- a/mm/slub.c -+++ b/mm/slub.c -@@ -249,7 +249,7 @@ static inline void *freelist_ptr(const struct kmem_cache *s, void *ptr, - unsigned long ptr_addr) - { - #ifdef CONFIG_SLAB_FREELIST_HARDENED -- return (void *)((unsigned long)ptr ^ s->random ^ ptr_addr); -+ return (void *)swab((unsigned long)ptr ^ s->random ^ ptr_addr); - #else - return ptr; - #endif --- -2.20.1 - -- 2.47.3