On Wed, Apr 15, 2020 at 09:51:21PM -0400, Sasha Levin wrote:
> On Wed, Apr 15, 2020 at 01:23:24PM +0200, gregkh@xxxxxxxxxxxxxxxxxxx wrote:
> > The patch below does not apply to the 5.6-stable tree.
> > If someone wants it applied there, or to any other stable or longterm
> > tree, then please email the backport, including the original git commit
> > id to <stable@xxxxxxxxxxxxxxx>.
> >
> > thanks,
> >
> > greg k-h
> >
> > ------------------ original commit in Linus's tree ------------------
> >
> > From b8fdef311a0bd9223f10754f94fdcf1a594a3457 Mon Sep 17 00:00:00 2001
> > From: Mark Brown <broonie@xxxxxxxxxx>
> > Date: Tue, 31 Mar 2020 20:44:59 +0100
> > Subject: [PATCH] arm64: Always force a branch protection mode when the
> > compiler has one
> >
> > Compilers with branch protection support can be configured to enable it by
> > default, it is likely that distributions will do this as part of deploying
> > branch protection system wide. As well as the slight overhead from having
> > some extra NOPs for unused branch protection features this can cause more
> > serious problems when the kernel is providing pointer authentication to
> > userspace but not built for pointer authentication itself. In that case our
> > switching of keys for userspace can affect the kernel unexpectedly, causing
> > pointer authentication instructions in the kernel to corrupt addresses.
> >
> > To ensure that we get consistent and reliable behaviour always explicitly
> > initialise the branch protection mode, ensuring that the kernel is built
> > the same way regardless of the compiler defaults.
> >
> > Fixes: 7503197562567 (arm64: add basic pointer authentication support)
> > Reported-by: Szabolcs Nagy <szabolcs.nagy@xxxxxxx>
> > Signed-off-by: Mark Brown <broonie@xxxxxxxxxx>
> > Cc: stable@xxxxxxxxxxxxxxx
> > [catalin.marinas@xxxxxxx: remove Kconfig option in favour of Makefile check]
> > Signed-off-by: Catalin Marinas <catalin.marinas@xxxxxxx>
>
> I don't think that this is needed anywhere without 74afda4016a7 ("arm64:
> compile the kernel with ptrauth return address signing")?
Good point. Mark, is the Fixes line above correct or it should have been
the one Sasha mentions?
--
Catalin
