Skip to contentSkip to conversation

Linux 6.6.149

DISCUSSION Greg Kroah-Hartman 3 participants 5 messages Aug 6 – Aug 7 Stable branch

lore
Share & tools
lore

Greg Kroah-Hartman

author maintainer
#0 lore raw

I'm announcing the release of the 6.6.149 kernel.

All users of the 6.6 kernel series must upgrade.

The updated 6.6.y git tree can be found at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-6.6.y
and can be browsed at the normal kernel.org git web browser:
https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary

thanks,

greg k-h

------------

 Makefile                             |    2 -
 arch/x86/entry/entry_64.S            |    8 ++++-
 arch/x86/include/asm/nospec-branch.h |   56 +++++++++++++++++++++++++++++++++++
 arch/x86/kernel/cpu/bugs.c           |   39 ++++++++++++++++++++++++
 arch/x86/lib/retpoline.S             |   20 ++++++++++++
 5 files changed, 123 insertions(+), 2 deletions(-)

Borislav Petkov (AMD) (1):
x86/bugs: Make Safe-RET robust against interrupt injection

Greg Kroah-Hartman (1):

      Linux 6.6.149
author maintainer
#1 lore raw
Makefile +1 -1
index 62de0a92ea10..f64070d333e2 100644
@@ -1,7 +1,7 @@
 # SPDX-License-Identifier: GPL-2.0
 VERSION = 6
 PATCHLEVEL = 6
-SUBLEVEL = 148
+SUBLEVEL = 149
 EXTRAVERSION =
 NAME = Pinguïn Aangedreven
arch/x86/entry/entry_64.S +7 -1
index 1f9e508ac075..3aee64b51921 100644
@@ -976,6 +976,8 @@ SYM_CODE_START(paranoid_entry)
 	IBRS_ENTER save_reg=%r15
 	UNTRAIN_RET_FROM_CALL
 
+	HANDLE_INTR_SAFERET 8(%rsp)
+
 	RET
 SYM_CODE_END(paranoid_entry)
 

@@ -1078,6 +1080,11 @@ SYM_CODE_START(error_entry)
 	movl	%ecx, %eax			/* zero extend */
 	cmpq	%rax, RIP+8(%rsp)
 	je	.Lbstep_iret
+
+	VALIDATE_UNRET_END
+
+	HANDLE_INTR_SAFERET 8(%rsp)
+
 	cmpq	$.Lgs_change, RIP+8(%rsp)
 	jne	.Lerror_entry_done_lfence
 

@@ -1096,7 +1103,6 @@ SYM_CODE_START(error_entry)
 	FENCE_SWAPGS_KERNEL_ENTRY
 	CALL_DEPTH_ACCOUNT
 	leaq	8(%rsp), %rax			/* return pt_regs pointer */
-	VALIDATE_UNRET_END
 	RET
 
 .Lbstep_iret:
arch/x86/include/asm/nospec-branch.h +56 -0

74 lines not on this page · raw message

arch/x86/kernel/cpu/bugs.c +39 -0
index 32a27c19acde..bf57acd42186 100644
@@ -3489,3 +3489,42 @@ ssize_t cpu_show_vmscape(struct device *dev, struct device_attribute *attr, char
 	return cpu_show_common(dev, attr, buf, X86_BUG_VMSCAPE);
 }
 #endif
+
+#ifdef CONFIG_MITIGATION_SRSO
+/*
+ * Called during exception/interrupt entry if interrupted during the
+ * safe-RET sequence.  The safe-RET sequence consists of 3 instructions:
+ *
+ *	CALL
+ *	LEA 8(%RSP), %RSP
+ *	RET
+ *
+ * An interrupt after the CALL or after the LEA could potentially lead
+ * to branch predictor poisoning and results in the sequence not being
+ * able to be safely resumed.
+ *
+ * Therefore, modify the regs state as if the remaining part of the
+ * safe-RET sequence executed so the interrupt returns back to the
+ * desired return target, instead of the to the safe-RET sequence.
+ */
+void noinstr handle_interrupted_saferet(struct pt_regs *regs)
+{
+	unsigned long rip = regs->ip;
+
+	if (rip == (unsigned long) srso_safe_ret ||
+	    rip == (unsigned long) srso_alias_safe_ret) {
+	    /* Modify stack pointer as if LEA executed: */
+	    regs->sp += 8;
+	}
+
+	/*
+	 * Adjust registers as if RET executed:
+	 *
+	 * 1. Read the return address off the stack and into rIP:
+	 */
+	regs->ip = *(unsigned long *)(regs->sp);
+
+	/* 2. Pop rIP off the stack: */
+	regs->sp += 8;
+}
+#endif /* CONFIG_MITIGATION_SRSO */
arch/x86/lib/retpoline.S +20 -0
index 91ce427d5af1..46404f46140e 100644
@@ -161,10 +161,24 @@ __EXPORT_THUNK(srso_alias_untrain_ret)
 
 	.pushsection .text..__x86.rethunk_safe
 SYM_START(srso_alias_safe_ret, SYM_L_GLOBAL, SYM_A_NONE)
+
+	/*
+	 * Tell objtool that those are not function pointers referenced by
+	 * __HANDLE_INTR_SAFERET(). Below too.
+	 */
+	ANNOTATE_NOENDBR
+
+	/*
+	 * Safe-RET sequence. If you need to change it, adjust
+	 * handle_interrupted_saferet() too.
+	 */
 	lea 8(%_ASM_SP), %_ASM_SP
 	UNWIND_HINT_FUNC
+
+	ANNOTATE_NOENDBR
 	ANNOTATE_UNRET_SAFE
 	ret
+	/* End of Safe-RET sequence */
 	int3
 SYM_FUNC_END(srso_alias_safe_ret)
 

@@ -199,8 +213,14 @@ SYM_START(srso_untrain_ret, SYM_L_LOCAL, SYM_A_NONE)
  * the stack.
  */
 SYM_INNER_LABEL(srso_safe_ret, SYM_L_GLOBAL)
+	/*
+	 * Safe-RET sequence. If you need to change it, adjust
+	 * handle_interrupted_saferet() too.
+	 */
 	lea 8(%_ASM_SP), %_ASM_SP
 	ret
+	/* End of Safe-RET sequence */
+
 	int3
 	int3
 	/* end of movabs */
#2 lore raw

CVE-2026-68480 mitigations for older stable series (was: Re: Linux 6.6.149)

In reply to Greg Kroah-Hartman

Hi Greg, hi Borislav,

Quoted 8 lines · Greg Kroah-Hartman

I'm announcing the release of the 6.6.149 kernel.

All users of the 6.6 kernel series must upgrade.

The updated 6.6.y git tree can be found at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-6.6.y
and can be browsed at the normal kernel.org git web browser:
https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary

It got mentioned outside of the stable list that the backports of 7e7f81cf6f5c ("x86/bugs: Make Safe-RET robust against interrupt injection") to address CVE-2026-68480 will not work. So raising the problem here.

In fact at least they depend on CONFIG_MITIGATION_SRSO, which only was renamed in a033eec9a06c ("x86/bugs: Rename CONFIG_CPU_SRSO => CONFIG_MITIGATION_SRSO") v6.9-rc1, correct?

Borislav, can you have a look for the older backports?

Regards,
Salvatore

#3 lore raw

Re: CVE-2026-68480 mitigations for older stable series (was: Re: Linux 6.6.149)

Hi,

Quoted 3 lines · Salvatore Bonaccorso

In fact at least they depend on CONFIG_MITIGATION_SRSO, which only was renamed in a033eec9a06c ("x86/bugs: Rename CONFIG_CPU_SRSO => CONFIG_MITIGATION_SRSO") v6.9-rc1, correct?

Yeah, I'm very sorry about that.

Quoted 1 line

Borislav, can you have a look for the older backports?

Already sent fixed versions to Greg, waiting for him to wake up.

Signature · 4 lines
Regards/Gruss,
    Boris.

https://people.kernel.org/tglx/notes-about-netiquette
#4 lore raw

Re: CVE-2026-68480 mitigations for older stable series (was: Re: Linux 6.6.149)

Quoted 7 lines · Borislav Petkov

Hi,

Quoted 3 lines · Salvatore Bonaccorso

In fact at least they depend on CONFIG_MITIGATION_SRSO, which only was renamed in a033eec9a06c ("x86/bugs: Rename CONFIG_CPU_SRSO => CONFIG_MITIGATION_SRSO") v6.9-rc1, correct?

Quoted 5 lines

Yeah, I'm very sorry about that.

Quoted 1 line

Borislav, can you have a look for the older backports?

Already sent fixed versions to Greg, waiting for him to wake up.

Fixes are out now.

Signature · 4 lines
Regards/Gruss,
    Boris.

https://people.kernel.org/tglx/notes-about-netiquette