This is a note to let you know that I've just added the patch titled
x86/entry: Avoid very early RET
to the 5.15-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
x86-entry-avoid-very-early-ret.patch
and it can be found in the queue-5.15 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
>From foo@baz Tue Jul 12 05:06:57 PM CEST 2022
From: Peter Zijlstra <peterz@xxxxxxxxxxxxx>
Date: Tue, 14 Jun 2022 23:15:46 +0200
Subject: x86/entry: Avoid very early RET
From: Peter Zijlstra <peterz@xxxxxxxxxxxxx>
commit 7c81c0c9210c9bfab2bae76aab2999de5bad27db upstream.
Commit
ee774dac0da1 ("x86/entry: Move PUSH_AND_CLEAR_REGS out of error_entry()")
manages to introduce a CALL/RET pair that is before SWITCH_TO_KERNEL_CR3,
which means it is before RETBleed can be mitigated.
Revert to an earlier version of the commit in Fixes. Down side is that
this will bloat .text size somewhat. The alternative is fully reverting
it.
The purpose of this patch was to allow migrating error_entry() to C,
including the whole of kPTI. Much care needs to be taken moving that
forward to not re-introduce this problem of early RETs.
Fixes: ee774dac0da1 ("x86/entry: Move PUSH_AND_CLEAR_REGS out of error_entry()")
Signed-off-by: Peter Zijlstra (Intel) <peterz@xxxxxxxxxxxxx>
Signed-off-by: Borislav Petkov <bp@xxxxxxx>
Reviewed-by: Josh Poimboeuf <jpoimboe@xxxxxxxxxx>
Signed-off-by: Borislav Petkov <bp@xxxxxxx>
Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@xxxxxxxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
arch/x86/entry/entry_64.S | 12 ++----------
1 file changed, 2 insertions(+), 10 deletions(-)
--- a/arch/x86/entry/entry_64.S
+++ b/arch/x86/entry/entry_64.S
@@ -314,14 +314,6 @@ SYM_CODE_END(ret_from_fork)
#endif
.endm
-/* Save all registers in pt_regs */
-SYM_CODE_START_LOCAL(push_and_clear_regs)
- UNWIND_HINT_FUNC
- PUSH_AND_CLEAR_REGS save_ret=1
- ENCODE_FRAME_POINTER 8
- RET
-SYM_CODE_END(push_and_clear_regs)
-
/**
* idtentry_body - Macro to emit code calling the C function
* @cfunc: C function to be called
@@ -329,8 +321,8 @@ SYM_CODE_END(push_and_clear_regs)
*/
.macro idtentry_body cfunc has_error_code:req
- call push_and_clear_regs
- UNWIND_HINT_REGS
+ PUSH_AND_CLEAR_REGS
+ ENCODE_FRAME_POINTER
/*
* Call error_entry() and switch to the task stack if from userspace.
Patches currently in stable-queue which might be from peterz@xxxxxxxxxxxxx are
queue-5.15/x86-sev-avoid-using-__x86_return_thunk.patch
queue-5.15/x86-ftrace-use-alternative-ret-encoding.patch
queue-5.15/objtool-re-add-unwind_hint_-save_restore.patch
queue-5.15/x86-bugs-add-retbleed-ibpb.patch
queue-5.15/x86-bugs-enable-stibp-for-jmp2ret.patch
queue-5.15/x86-retpoline-cleanup-some-ifdefery.patch
queue-5.15/kvm-vmx-flatten-__vmx_vcpu_run.patch
queue-5.15/x86-kvm-vmx-make-noinstr-clean.patch
queue-5.15/objtool-x86-replace-alternatives-with-.retpoline_sites.patch
queue-5.15/x86-retbleed-add-fine-grained-kconfig-knobs.patch
queue-5.15/x86-cpu-amd-add-spectral-chicken.patch
queue-5.15/kvm-vmx-fix-ibrs-handling-after-vmexit.patch
queue-5.15/kvm-vmx-prevent-guest-rsb-poisoning-attacks-with-eibrs.patch
queue-5.15/x86-vsyscall_emu-64-don-t-use-ret-in-vsyscall-emulation.patch
queue-5.15/x86-add-magic-amd-return-thunk.patch
queue-5.15/x86-bugs-keep-a-per-cpu-ia32_spec_ctrl-value.patch
queue-5.15/x86-objtool-create-.return_sites.patch
queue-5.15/x86-alternative-handle-jcc-__x86_indirect_thunk_-reg.patch
queue-5.15/x86-kvm-fix-setcc-emulation-for-return-thunks.patch
queue-5.15/x86-retpoline-swizzle-retpoline-thunk.patch
queue-5.15/x86-speculation-fix-firmware-entry-spec_ctrl-handling.patch
queue-5.15/x86-retpoline-remove-unused-replacement-symbols.patch
queue-5.15/x86-speculation-add-spectre_v2-ibrs-option-to-support-kernel-ibrs.patch
queue-5.15/x86-xen-add-untrain_ret.patch
queue-5.15/bpf-x86-respect-x86_feature_retpoline.patch
queue-5.15/x86-undo-return-thunk-damage.patch
queue-5.15/x86-entry-avoid-very-early-ret.patch
queue-5.15/x86-entry-move-push_and_clear_regs-back-into-error_entry.patch
queue-5.15/x86-retpoline-create-a-retpoline-thunk-array.patch
queue-5.15/x86-asm-fix-register-order.patch
queue-5.15/x86-speculation-fill-rsb-on-vmexit-for-ibrs.patch
queue-5.15/objtool-add-entry-unret-validation.patch
queue-5.15/objtool-shrink-struct-instruction.patch
queue-5.15/kvm-vmx-convert-launched-argument-to-flags.patch
queue-5.15/x86-bpf-use-alternative-ret-encoding.patch
queue-5.15/x86-common-stamp-out-the-stepping-madness.patch
queue-5.15/x86-bugs-split-spectre_v2_select_mitigation-and-spectre_v2_user_select_mitigation.patch
queue-5.15/x86-bugs-report-intel-retbleed-vulnerability.patch
queue-5.15/bpf-x86-simplify-computing-label-offsets.patch
queue-5.15/x86-cpufeatures-move-retpoline-flags-to-word-11.patch
queue-5.15/x86-speculation-fix-spec_ctrl-write-on-smt-state-change.patch
queue-5.15/x86-retpoline-use-mfunction-return.patch
queue-5.15/x86-xen-rename-sys-entry-points.patch
queue-5.15/x86-bugs-optimize-spec_ctrl-msr-writes.patch
queue-5.15/x86-bugs-report-amd-retbleed-vulnerability.patch
queue-5.15/x86-static_call-use-alternative-ret-encoding.patch
queue-5.15/x86-speculation-fix-rsb-filling-with-config_retpoline-n.patch
queue-5.15/x86-asm-fixup-odd-gen-for-each-reg.h-usage.patch
queue-5.15/x86-alternative-add-debug-prints-to-apply_retpolines.patch
queue-5.15/x86-use-return-thunk-in-asm-code.patch
queue-5.15/objtool-classify-symbols.patch
queue-5.15/intel_idle-disable-ibrs-during-long-idle.patch
queue-5.15/x86-retpoline-move-the-retpoline-thunk-declarations-to-nospec-branch.h.patch
queue-5.15/x86-alternative-implement-.retpoline_sites-support.patch
queue-5.15/x86-alternative-try-inline-spectre_v2-retpoline-amd.patch
queue-5.15/x86-entry-remove-skip_r11rcx.patch
queue-5.15/objtool-explicitly-avoid-self-modifying-code-in-.altinstr_replacement.patch
queue-5.15/x86-speculation-use-cached-host-spec_ctrl-value-for-guest-entry-exit.patch
queue-5.15/x86-bugs-add-amd-retbleed-boot-parameter.patch
queue-5.15/x86-entry-add-kernel-ibrs-implementation.patch
queue-5.15/objtool-treat-.text.__x86.-as-noinstr.patch
queue-5.15/objtool-introduce-cfi-hash.patch
queue-5.15/objtool-default-ignore-int3-for-unreachable.patch
queue-5.15/objtool-update-retpoline-validation.patch
