1. 05 Oct, 2018 3 commits
  2. 02 Aug, 2018 5 commits
    • Russell King's avatar
      ARM: spectre-v1: mitigate user accesses · a3c0f847
      Russell King authored
      
      
      Spectre variant 1 attacks are about this sequence of pseudo-code:
      
      	index = load(user-manipulated pointer);
      	access(base + index * stride);
      
      In order for the cache side-channel to work, the access() must me made
      to memory which userspace can detect whether cache lines have been
      loaded.  On 32-bit ARM, this must be either user accessible memory, or
      a kernel mapping of that same user accessible memory.
      
      The problem occurs when the load() speculatively loads privileged data,
      and the subsequent access() is made to user accessible memory.
      
      Any load() which makes use of a user-maniplated pointer is a potential
      problem if the data it has loaded is used in a subsequent access.  This
      also applies for the access() if the data loaded by that access is used
      by a subsequent access.
      
      Harden the get_user() accessors against Spectre attacks by forcing out
      of bounds addresses to a NULL pointer.  This prevents get_user() being
      used as the load() step above.  As a side effect, put_user() will also
      be affected even though it isn't implicated.
      
      Also harden copy_from_user() by redoing the bounds check within the
      arm_copy_from_user() code, and NULLing the pointer if out of bounds.
      Acked-by: default avatarMark Rutland <mark.rutland@arm.com>
      Signed-off-by: default avatarRussell King <rmk+kernel@armlinux.org.uk>
      a3c0f847
    • Russell King's avatar
      ARM: spectre-v1: use get_user() for __get_user() · b1cd0a14
      Russell King authored
      
      
      Fixing __get_user() for spectre variant 1 is not sane: we would have to
      add address space bounds checking in order to validate that the location
      should be accessed, and then zero the address if found to be invalid.
      
      Since __get_user() is supposed to avoid the bounds check, and this is
      exactly what get_user() does, there's no point having two different
      implementations that are doing the same thing.  So, when the Spectre
      workarounds are required, make __get_user() an alias of get_user().
      Acked-by: default avatarMark Rutland <mark.rutland@arm.com>
      Signed-off-by: default avatarRussell King <rmk+kernel@armlinux.org.uk>
      b1cd0a14
    • Russell King's avatar
      ARM: use __inttype() in get_user() · d09fbb32
      Russell King authored
      
      
      Borrow the x86 implementation of __inttype() to use in get_user() to
      select an integer type suitable to temporarily hold the result value.
      This is necessary to avoid propagating the volatile nature of the
      result argument, which can cause the following warning:
      
      lib/iov_iter.c:413:5: warning: optimization may eliminate reads and/or writes to register variables [-Wvolatile-register-var]
      Acked-by: default avatarMark Rutland <mark.rutland@arm.com>
      Signed-off-by: default avatarRussell King <rmk+kernel@armlinux.org.uk>
      d09fbb32
    • Russell King's avatar
      ARM: oabi-compat: copy semops using __copy_from_user() · 8c8484a1
      Russell King authored
      
      
      __get_user_error() is used as a fast accessor to make copying structure
      members as efficient as possible.  However, with software PAN and the
      recent Spectre variant 1, the efficiency is reduced as these are no
      longer fast accessors.
      
      In the case of software PAN, it has to switch the domain register around
      each access, and with Spectre variant 1, it would have to repeat the
      access_ok() check for each access.
      
      Rather than using __get_user_error() to copy each semops element member,
      copy each semops element in full using __copy_from_user().
      Acked-by: default avatarMark Rutland <mark.rutland@arm.com>
      Signed-off-by: default avatarRussell King <rmk+kernel@armlinux.org.uk>
      8c8484a1
    • Russell King's avatar
      ARM: vfp: use __copy_from_user() when restoring VFP state · 42019fc5
      Russell King authored
      
      
      __get_user_error() is used as a fast accessor to make copying structure
      members in the signal handling path as efficient as possible.  However,
      with software PAN and the recent Spectre variant 1, the efficiency is
      reduced as these are no longer fast accessors.
      
      In the case of software PAN, it has to switch the domain register around
      each access, and with Spectre variant 1, it would have to repeat the
      access_ok() check for each access.
      
      Use __copy_from_user() rather than __get_user_err() for individual
      members when restoring VFP state.
      Acked-by: default avatarMark Rutland <mark.rutland@arm.com>
      Signed-off-by: default avatarRussell King <rmk+kernel@armlinux.org.uk>
      42019fc5
  3. 26 Jul, 2018 1 commit
    • Russell King's avatar
      ARM: signal: copy registers using __copy_from_user() · c32cd419
      Russell King authored
      
      
      __get_user_error() is used as a fast accessor to make copying structure
      members in the signal handling path as efficient as possible.  However,
      with software PAN and the recent Spectre variant 1, the efficiency is
      reduced as these are no longer fast accessors.
      
      In the case of software PAN, it has to switch the domain register around
      each access, and with Spectre variant 1, it would have to repeat the
      access_ok() check for each access.
      
      It becomes much more efficient to use __copy_from_user() instead, so
      let's use this for the ARM integer registers.
      Acked-by: default avatarMark Rutland <mark.rutland@arm.com>
      Signed-off-by: default avatarRussell King <rmk+kernel@armlinux.org.uk>
      c32cd419
  4. 31 May, 2018 18 commits
  5. 01 Apr, 2018 1 commit
  6. 31 Mar, 2018 5 commits
    • Linus Torvalds's avatar
      Merge branch 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · 10b84dad
      Linus Torvalds authored
      Pull perf fixes from Ingo Molnar:
       "Two fixlets"
      
      * 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        perf/hwbp: Simplify the perf-hwbp code, fix documentation
        perf/x86/intel: Fix linear IP of PEBS real_ip on Haswell and later CPUs
      10b84dad
    • Linus Torvalds's avatar
      Merge branch 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · ad0500ca
      Linus Torvalds authored
      Pull x86 fixes from Ingo Molnar:
       "Two UV platform fixes, and a kbuild fix"
      
      * 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        x86/platform/UV: Fix critical UV MMR address error
        x86/platform/uv/BAU: Add APIC idt entry
        x86/purgatory: Avoid creating stray .<pid>.d files, remove -MD from KBUILD_CFLAGS
      ad0500ca
    • Linus Torvalds's avatar
      Merge branch 'x86-pti-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · 93e04d4a
      Linus Torvalds authored
      Pull x86 PTI fixes from Ingo Molnar:
       "Two fixes: a relatively simple objtool fix that makes Clang built
        kernels work with ORC debug info, plus an alternatives macro fix"
      
      * 'x86-pti-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        x86/alternatives: Fixup alternative_call_2
        objtool: Add Clang support
      93e04d4a
    • Linus Torvalds's avatar
      Merge tag 'kbuild-fixes-v4.16-3' of... · b5dbc287
      Linus Torvalds authored
      Merge tag 'kbuild-fixes-v4.16-3' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild
      
      Pull Kbuild fixes from Masahiro Yamada:
      
       - fix missed rebuild of TRIM_UNUSED_KSYMS
      
       - fix rpm-pkg for GNU tar >= 1.29
      
       - include scripts/dtc/include-prefixes/* to kernel header deb-pkg
      
       - add -no-integrated-as option ealier to fix building with Clang
      
       - fix netfilter Makefile for parallel building
      
      * tag 'kbuild-fixes-v4.16-3' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild:
        netfilter: nf_nat_snmp_basic: add correct dependency to Makefile
        kbuild: rpm-pkg: Support GNU tar >= 1.29
        builddeb: Fix header package regarding dtc source links
        kbuild: set no-integrated-as before incl. arch Makefile
        kbuild: make scripts/adjust_autoksyms.sh robust against timestamp races
      b5dbc287
    • Linus Torvalds's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net · a44406ec
      Linus Torvalds authored
      Pull networking fixes from David Miller:
      
       1) Fix RCU locking in xfrm_local_error(), from Taehee Yoo.
      
       2) Fix return value assignments and thus error checking in
          iwl_mvm_start_ap_ibss(), from Johannes Berg.
      
       3) Don't count header length twice in vti4, from Stefano Brivio.
      
       4) Fix deadlock in rt6_age_examine_exception, from Eric Dumazet.
      
       5) Fix out-of-bounds access in nf_sk_lookup_slow{v4,v6}() from Subash
          Abhinov.
      
       6) Check nladdr size in netlink_connect(), from Alexander Potapenko.
      
       7) VF representor SQ numbers are 32 not 16 bits, in mlx5 driver, from
          Or Gerlitz.
      
       8) Out of bounds read in skb_network_protocol(), from Eric Dumazet.
      
       9) r8169 driver sets driver data pointer after register_netdev() which
          is too late. Fix from Heiner Kallweit.
      
      10) Fix memory leak in mlx4 driver, from Moshe Shemesh.
      
      11) The multi-VLAN decap fix added a regression when dealing with device
          that lack a MAC header, such as tun. Fix from Toshiaki Makita.
      
      12) Fix integer overflow in dynamic interrupt coalescing code. From Tal
          Gilboa.
      
      13) Use after free in vrf code, from David Ahern.
      
      14) IPV6 route leak between VRFs fix, also from David Ahern.
      
      * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (81 commits)
        net: mvneta: fix enable of all initialized RXQs
        net/ipv6: Fix route leaking between VRFs
        vrf: Fix use after free and double free in vrf_finish_output
        ipv6: sr: fix seg6 encap performances with TSO enabled
        net/dim: Fix int overflow
        vlan: Fix vlan insertion for packets without ethernet header
        net: Fix untag for vlan packets without ethernet header
        atm: iphase: fix spelling mistake: "Receiverd" -> "Received"
        vhost: validate log when IOTLB is enabled
        qede: Do not drop rx-checksum invalidated packets.
        hv_netvsc: enable multicast if necessary
        ip_tunnel: Resolve ipsec merge conflict properly.
        lan78xx: Crash in lan78xx_writ_reg (Workqueue: events lan78xx_deferred_multicast_write)
        qede: Fix barrier usage after tx doorbell write.
        vhost: correctly remove wait queue during poll failure
        net/mlx4_core: Fix memory leak while delete slave's resources
        net/mlx4_en: Fix mixed PFC and Global pause user control requests
        net/smc: use announced length in sock_recvmsg()
        llc: properly handle dev_queue_xmit() return value
        strparser: Fix sign of err codes
        ...
      a44406ec
  7. 30 Mar, 2018 7 commits