Linux 7.1.7
Greg Kroah-Hartman
maintainerI'm announcing the release of the 7.1.7 kernel.
All users of the 7.1 kernel series must upgrade.
The updated 7.1.y git tree can be found at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-7.1.y
and can be browsed at the normal kernel.org git web browser:
https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary
thanks,
greg k-h
------------
Makefile | 2 - arch/x86/entry/entry_64.S | 8 ++++ arch/x86/include/asm/nospec-branch.h | 57 +++++++++++++++++++++++++++++++++++ arch/x86/kernel/cpu/bugs.c | 39 +++++++++++++++++++++++ arch/x86/lib/retpoline.S | 20 ++++++++++++ 5 files changed, 124 insertions(+), 2 deletions(-)
Borislav Petkov (AMD) (1):
x86/bugs: Make Safe-RET robust against interrupt injection
Greg Kroah-Hartman (1):
Linux 7.1.7
Greg Kroah-Hartman
maintainerMakefile +1 -1
@@ -1,7 +1,7 @@ # SPDX-License-Identifier: GPL-2.0 VERSION = 7 PATCHLEVEL = 1 -SUBLEVEL = 6 +SUBLEVEL = 7 EXTRAVERSION = NAME = Baby Opossum Posse
arch/x86/entry/entry_64.S +7 -1
@@ -937,6 +937,8 @@ SYM_CODE_START(paranoid_entry) IBRS_ENTER save_reg=%r15 UNTRAIN_RET_FROM_CALL + HANDLE_INTR_SAFERET 8(%rsp) + RET SYM_CODE_END(paranoid_entry)
@@ -1039,6 +1041,11 @@ SYM_CODE_START(error_entry) movl %ecx, %eax /* zero extend */ cmpq %rax, RIP+8(%rsp) je .Lbstep_iret + + VALIDATE_UNRET_END + + HANDLE_INTR_SAFERET 8(%rsp) + cmpq $.Lgs_change, RIP+8(%rsp) jne .Lerror_entry_done_lfence
@@ -1057,7 +1064,6 @@ SYM_CODE_START(error_entry) FENCE_SWAPGS_KERNEL_ENTRY CALL_DEPTH_ACCOUNT leaq 8(%rsp), %rax /* return pt_regs pointer */ - VALIDATE_UNRET_END RET .Lbstep_iret:
arch/x86/include/asm/nospec-branch.h +57 -0
81 lines not on this page · raw message
arch/x86/kernel/cpu/bugs.c +39 -0
@@ -3775,3 +3775,42 @@ void __warn_thunk(void) {WARN_ONCE (1 ,"Unpatched return thunk in use. This should not happen!\n" ); } + +#ifdef CONFIG_MITIGATION_SRSO +/* +* Called during exception/interrupt entry if interrupted during the +* safe-RET sequence. The safe-RET sequence consists of 3 instructions: +* +* CALL +* LEA 8(%RSP), %RSP +* RET +* +* An interrupt after the CALL or after the LEA could potentially lead +* to branch predictor poisoning and results in the sequence not being +* able to be safely resumed. +* +* Therefore, modify the regs state as if the remaining part of the +* safe-RET sequence executed so the interrupt returns back to the +* desired return target, instead of the to the safe-RET sequence. +*/ +void noinstr handle_interrupted_saferet(struct pt_regs *regs) +{ +unsigned long rip = regs->ip; + +if (rip == (unsigned long ) srso_safe_ret || + rip == (unsigned long ) srso_alias_safe_ret) { +/* Modify stack pointer as if LEA executed: */ + regs->sp +=8 ; + } + +/* +* Adjust registers as if RET executed: +* +* 1. Read the return address off the stack and into rIP: +*/ + regs->ip = *(unsigned long *)(regs->sp); + +/* 2. Pop rIP off the stack: */ + regs->sp +=8 ; +} +#endif /* CONFIG_MITIGATION_SRSO */
arch/x86/lib/retpoline.S +20 -0
@@ -207,10 +207,24 @@ __EXPORT_THUNK(srso_alias_untrain_ret) .pushsection .text..__x86.rethunk_safe SYM_CODE_START_NOALIGN(srso_alias_safe_ret) + + /* + * Tell objtool that those are not function pointers referenced by + * __HANDLE_INTR_SAFERET(). Below too. + */ + ANNOTATE_NOENDBR + + /* + * Safe-RET sequence. If you need to change it, adjust + * handle_interrupted_saferet() too. + */ lea 8(%_ASM_SP), %_ASM_SP UNWIND_HINT_FUNC + + ANNOTATE_NOENDBR ANNOTATE_UNRET_SAFE ret + /* End of Safe-RET sequence */ int3 SYM_FUNC_END(srso_alias_safe_ret)
@@ -245,8 +259,14 @@ SYM_CODE_START_LOCAL_NOALIGN(srso_untrain_ret) * the stack. */ SYM_INNER_LABEL(srso_safe_ret, SYM_L_GLOBAL) + /* + * Safe-RET sequence. If you need to change it, adjust + * handle_interrupted_saferet() too. + */ lea 8(%_ASM_SP), %_ASM_SP ret + /* End of Safe-RET sequence */ + int3 int3 /* end of movabs */