Linux 5.15.214
Greg Kroah-Hartman
maintainerI'm announcing the release of the 5.15.214 kernel.
All users of the 5.15 kernel series must upgrade.
The updated 5.15.y git tree can be found at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-5.15.y
and can be browsed at the normal kernel.org git web browser:
https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary
thanks,
greg k-h
------------
Makefile | 2 - arch/x86/entry/entry_64.S | 5 +++ arch/x86/include/asm/nospec-branch.h | 56 +++++++++++++++++++++++++++++++++++ arch/x86/kernel/cpu/bugs.c | 39 ++++++++++++++++++++++++ arch/x86/lib/retpoline.S | 20 ++++++++++++ 5 files changed, 121 insertions(+), 1 deletion(-)
Borislav Petkov (AMD) (1):
x86/bugs: Make Safe-RET robust against interrupt injection
Greg Kroah-Hartman (1):
Linux 5.15.214
Greg Kroah-Hartman
maintainerMakefile +1 -1
@@ -1,7 +1,7 @@ # SPDX-License-Identifier: GPL-2.0 VERSION = 5 PATCHLEVEL = 15 -SUBLEVEL = 213 +SUBLEVEL = 214 EXTRAVERSION = NAME = Trick or Treat
arch/x86/entry/entry_64.S +5 -0
@@ -941,6 +941,8 @@ SYM_CODE_START_LOCAL(paranoid_entry) IBRS_ENTER save_reg=%r15 UNTRAIN_RET + HANDLE_INTR_SAFERET 8(%rsp) + RET SYM_CODE_END(paranoid_entry)
@@ -1045,6 +1047,9 @@ SYM_CODE_START_LOCAL(error_entry) movl %ecx, %eax /* zero extend */ cmpq %rax, RIP+8(%rsp) je .Lbstep_iret + + HANDLE_INTR_SAFERET 8(%rsp) + cmpq $.Lgs_change, RIP+8(%rsp) jne .Lerror_entry_done_lfence
arch/x86/include/asm/nospec-branch.h +56 -0
74 lines not on this page · raw message
arch/x86/kernel/cpu/bugs.c +39 -0
@@ -3397,3 +3397,42 @@ ssize_t cpu_show_vmscape(struct device *dev, struct device_attribute *attr, charreturn cpu_show_common (dev, attr, buf,X86_BUG_VMSCAPE ); }#endif + +#ifdef CONFIG_MITIGATION_SRSO +/* +* Called during exception/interrupt entry if interrupted during the +* safe-RET sequence. The safe-RET sequence consists of 3 instructions: +* +* CALL +* LEA 8(%RSP), %RSP +* RET +* +* An interrupt after the CALL or after the LEA could potentially lead +* to branch predictor poisoning and results in the sequence not being +* able to be safely resumed. +* +* Therefore, modify the regs state as if the remaining part of the +* safe-RET sequence executed so the interrupt returns back to the +* desired return target, instead of the to the safe-RET sequence. +*/ +void noinstr handle_interrupted_saferet(struct pt_regs *regs) +{ +unsigned long rip = regs->ip; + +if (rip == (unsigned long ) srso_safe_ret || + rip == (unsigned long ) srso_alias_safe_ret) { +/* Modify stack pointer as if LEA executed: */ + regs->sp +=8 ; + } + +/* +* Adjust registers as if RET executed: +* +* 1. Read the return address off the stack and into rIP: +*/ + regs->ip = *(unsigned long *)(regs->sp); + +/* 2. Pop rIP off the stack: */ + regs->sp +=8 ; +} +#endif /* CONFIG_MITIGATION_SRSO */
arch/x86/lib/retpoline.S +20 -0
@@ -112,10 +112,24 @@ __EXPORT_THUNK(srso_alias_untrain_ret) #endif SYM_START(srso_alias_safe_ret, SYM_L_GLOBAL, SYM_A_NONE) + + /* + * Tell objtool that those are not function pointers referenced by + * __HANDLE_INTR_SAFERET(). Below too. + */ + ANNOTATE_NOENDBR + + /* + * Safe-RET sequence. If you need to change it, adjust + * handle_interrupted_saferet() too. + */ lea 8(%_ASM_SP), %_ASM_SP UNWIND_HINT_FUNC + + ANNOTATE_NOENDBR ANNOTATE_UNRET_SAFE ret + /* End of Safe-RET sequence */ int3 SYM_FUNC_END(srso_alias_safe_ret)
@@ -230,8 +244,14 @@ SYM_START(srso_untrain_ret, SYM_L_GLOBAL, SYM_A_NONE) * the stack. */ SYM_INNER_LABEL(srso_safe_ret, SYM_L_GLOBAL) + /* + * Safe-RET sequence. If you need to change it, adjust + * handle_interrupted_saferet() too. + */ lea 8(%_ASM_SP), %_ASM_SP ret + /* End of Safe-RET sequence */ + int3 int3 /* end of movabs */