1. photon
  2. Commit 4f91331e0f5275d9c4cd08237fdde76d1327675a
Browse code

kernels: Update to version 4.9.118

Also, remove the remaining out-of-tree spectre patches, since the
existing spectre mitigations in 4.9.y have rendered them obsolete.

Change-Id: Iad5a706c901e89ef0df0bd52a042c9b2c8b00acb
Reviewed-on: http://photon-jenkins.eng.vmware.com:8082/5455
Tested-by: gerrit-photon <photon-checkins@vmware.com>
Reviewed-by: Alexey Makhalov <amakhalov@vmware.com>

Srivatsa S. Bhat authored on 2018/08/08 08:07:15
Showing 19 changed files
SPECS/linux-api-headers/linux-api-headers.spec
History View file @ 4f91331
... ... 
@@ -1,6 +1,6 @@
1 1 
 Summary:	Linux API header files
2 2 
 Name:		linux-api-headers
3 
-Version:	4.9.116
3 
+Version:	4.9.118
4 4 
 Release:	1%{?dist}
5 5 
 License:	GPLv2
6 6 
 URL:		http://www.kernel.org/
... ... 
@@ -8,7 +8,7 @@ Group:		System Environment/Kernel
8 8 
 Vendor:		VMware, Inc.
9 9 
 Distribution: Photon
10 10 
 Source0:        http://www.kernel.org/pub/linux/kernel/v4.x/linux-%{version}.tar.xz
11 
-%define sha1 linux=ebd02e892297444ea927a45184f10f58fc77dea1
11 
+%define sha1 linux=1f441c2113d0b7bba57dd8f6e5f5db07d222d47b
12 12 
 BuildArch:	noarch
13 13 
 Patch0:         Implement-the-f-xattrat-family-of-functions.patch
14 14 
 %description
... ... 
@@ -27,6 +27,8 @@ find /%{buildroot}%{_includedir} \( -name .install -o -name ..install.cmd \) -de
27 27 
 %defattr(-,root,root)
28 28 
 %{_includedir}/*
29 29 
 %changelog
30 
+*   Tue Aug 07 2018 Srivatsa S. Bhat <srivatsa@csail.mit.edu> 4.9.118-1
31 
+-   Update to version 4.9.118
30 32 
 *   Mon Jul 30 2018 Srivatsa S. Bhat <srivatsa@csail.mit.edu> 4.9.116-1
31 33 
 -   Update to version 4.9.116
32 34 
 *   Mon Jul 23 2018 srinidhira0 <srinidhir@vmware.com> 4.9.114-1
SPECS/linux/linux-aws.spec
History View file @ 4f91331
... ... 
@@ -1,7 +1,7 @@
1 1 
 %global security_hardening none
2 2 
 Summary:        Kernel
3 3 
 Name:           linux-aws
4 
-Version:        4.9.116
4 
+Version:        4.9.118
5 5 
 Release:        1%{?kat_build:.%kat_build}%{?dist}
6 6 
 License:    	GPLv2
7 7 
 URL:        	http://www.kernel.org/
... ... 
@@ -9,7 +9,7 @@ Group:        	System Environment/Kernel
9 9 
 Vendor:         VMware, Inc.
10 10 
 Distribution: 	Photon
11 11 
 Source0:        http://www.kernel.org/pub/linux/kernel/v4.x/linux-%{version}.tar.xz
12 
-%define sha1 linux=ebd02e892297444ea927a45184f10f58fc77dea1
12 
+%define sha1 linux=1f441c2113d0b7bba57dd8f6e5f5db07d222d47b
13 13 
 Source1:	config-aws
14 14 
 Source2:	initramfs.trigger
15 15 
 # common
... ... 
@@ -66,22 +66,6 @@ Patch46:        0001-xfs-move-inode-fork-verifiers-to-xfs-dinode-verify.patch
66 66 
 Patch47:        0002-xfs-verify-dinode-header-first.patch
67 67 
 Patch48:        0003-xfs-enhance-dinode-verifier.patch
68 68
69 
-# For Spectre
70 
-Patch52: 0141-locking-barriers-introduce-new-observable-speculatio.patch
71 
-Patch53: 0142-bpf-prevent-speculative-execution-in-eBPF-interprete.patch
72 
-Patch54: 0143-x86-bpf-jit-prevent-speculative-execution-when-JIT-i.patch
73 
-Patch55: 0144-uvcvideo-prevent-speculative-execution.patch
74 
-Patch56: 0145-carl9170-prevent-speculative-execution.patch
75 
-Patch57: 0146-p54-prevent-speculative-execution.patch
76 
-Patch58: 0147-qla2xxx-prevent-speculative-execution.patch
77 
-Patch59: 0148-cw1200-prevent-speculative-execution.patch
78 
-Patch60: 0149-Thermal-int340x-prevent-speculative-execution.patch
79 
-Patch61: 0150-ipv4-prevent-speculative-execution.patch
80 
-Patch62: 0151-ipv6-prevent-speculative-execution.patch
81 
-Patch64: 0153-net-mpls-prevent-speculative-execution.patch
82 
-Patch65: 0154-udf-prevent-speculative-execution.patch
83 
-Patch66: 0155-userns-prevent-speculative-execution.patch
84 
-
85 69 
 Patch70: 0001-fork-unconditionally-clear-stack-on-fork.patch
86 70
87 71 
 # Out-of-tree patches from AppArmor:
... ... 
@@ -250,21 +234,6 @@ This package contains the 'perf' performance analysis tools for Linux kernel.
250 250 
 %patch47 -p1
251 251 
 %patch48 -p1
252 252
253 
-%patch52 -p1
254 
-%patch53 -p1
255 
-%patch54 -p1
256 
-%patch55 -p1
257 
-%patch56 -p1
258 
-%patch57 -p1
259 
-%patch58 -p1
260 
-%patch59 -p1
261 
-%patch60 -p1
262 
-%patch61 -p1
263 
-%patch62 -p1
264 
-%patch64 -p1
265 
-%patch65 -p1
266 
-%patch66 -p1
267 
-
268 253 
 %patch70 -p1
269 254
270 255 
 %patch71 -p1
... ... 
@@ -475,6 +444,8 @@ ln -sf %{name}-%{uname_r}.cfg /boot/photon.cfg
475 475 
 /usr/share/doc/*
476 476
477 477 
 %changelog
478 
+*   Tue Aug 07 2018 Srivatsa S. Bhat <srivatsa@csail.mit.edu> 4.9.118-1
479 
+-   Update to version 4.9.118
478 480 
 *   Mon Jul 30 2018 Srivatsa S. Bhat <srivatsa@csail.mit.edu> 4.9.116-1
479 481 
 -   Update to version 4.9.116 and clear stack on fork.
480 482 
 *   Mon Jul 23 2018 srinidhira0 <srinidhir@vmware.com> 4.9.114-1
SPECS/linux/linux-esx.spec
History View file @ 4f91331
... ... 
@@ -1,7 +1,7 @@
1 1 
 %global security_hardening none
2 2 
 Summary:        Kernel
3 3 
 Name:           linux-esx
4 
-Version:        4.9.116
4 
+Version:        4.9.118
5 5 
 Release:        1%{?dist}
6 6 
 License:        GPLv2
7 7 
 URL:            http://www.kernel.org/
... ... 
@@ -9,7 +9,7 @@ Group:          System Environment/Kernel
9 9 
 Vendor:         VMware, Inc.
10 10 
 Distribution:   Photon
11 11 
 Source0:        http://www.kernel.org/pub/linux/kernel/v4.x/linux-%{version}.tar.xz
12 
-%define sha1 linux=ebd02e892297444ea927a45184f10f58fc77dea1
12 
+%define sha1 linux=1f441c2113d0b7bba57dd8f6e5f5db07d222d47b
13 13 
 Source1:        config-esx
14 14 
 Source2:        initramfs.trigger
15 15 
 # common
... ... 
@@ -63,22 +63,6 @@ Patch46:        0001-xfs-move-inode-fork-verifiers-to-xfs-dinode-verify.patch
63 63 
 Patch47:        0002-xfs-verify-dinode-header-first.patch
64 64 
 Patch48:        0003-xfs-enhance-dinode-verifier.patch
65 65
66 
-# For Spectre
67 
-Patch52: 0141-locking-barriers-introduce-new-observable-speculatio.patch
68 
-Patch53: 0142-bpf-prevent-speculative-execution-in-eBPF-interprete.patch
69 
-Patch54: 0143-x86-bpf-jit-prevent-speculative-execution-when-JIT-i.patch
70 
-Patch55: 0144-uvcvideo-prevent-speculative-execution.patch
71 
-Patch56: 0145-carl9170-prevent-speculative-execution.patch
72 
-Patch57: 0146-p54-prevent-speculative-execution.patch
73 
-Patch58: 0147-qla2xxx-prevent-speculative-execution.patch
74 
-Patch59: 0148-cw1200-prevent-speculative-execution.patch
75 
-Patch60: 0149-Thermal-int340x-prevent-speculative-execution.patch
76 
-Patch61: 0150-ipv4-prevent-speculative-execution.patch
77 
-Patch62: 0151-ipv6-prevent-speculative-execution.patch
78 
-Patch64: 0153-net-mpls-prevent-speculative-execution.patch
79 
-Patch65: 0154-udf-prevent-speculative-execution.patch
80 
-Patch66: 0155-userns-prevent-speculative-execution.patch
81 
-
82 66 
 Patch70: 0001-fork-unconditionally-clear-stack-on-fork.patch
83 67
84 68
... ... 
@@ -160,21 +144,6 @@ The Linux package contains the Linux kernel doc files
160 160 
 %patch47 -p1
161 161 
 %patch48 -p1
162 162
163 
-%patch52 -p1
164 
-%patch53 -p1
165 
-%patch54 -p1
166 
-%patch55 -p1
167 
-%patch56 -p1
168 
-%patch57 -p1
169 
-%patch58 -p1
170 
-%patch59 -p1
171 
-%patch60 -p1
172 
-%patch61 -p1
173 
-%patch62 -p1
174 
-%patch64 -p1
175 
-%patch65 -p1
176 
-%patch66 -p1
177 
-
178 163 
 %patch70 -p1
179 164
180 165 
 %build
... ... 
@@ -272,6 +241,8 @@ ln -sf linux-%{uname_r}.cfg /boot/photon.cfg
272 272 
 /usr/src/linux-headers-%{uname_r}
273 273
274 274 
 %changelog
275 
+*   Tue Aug 07 2018 Srivatsa S. Bhat <srivatsa@csail.mit.edu> 4.9.118-1
276 
+-   Update to version 4.9.118
275 277 
 *   Mon Jul 30 2018 Srivatsa S. Bhat <srivatsa@csail.mit.edu> 4.9.116-1
276 278 
 -   Update to version 4.9.116 and clear stack on fork.
277 279 
 *   Mon Jul 23 2018 srinidhira0 <srinidhir@vmware.com> 4.9.114-1
SPECS/linux/linux-secure.spec
History View file @ 4f91331
... ... 
@@ -1,7 +1,7 @@
1 1 
 %global security_hardening none
2 2 
 Summary:        Kernel
3 3 
 Name:           linux-secure
4 
-Version:        4.9.116
4 
+Version:        4.9.118
5 5 
 Release:        1%{?kat_build:.%kat_build}%{?dist}
6 6 
 License:        GPLv2
7 7 
 URL:            http://www.kernel.org/
... ... 
@@ -9,7 +9,7 @@ Group:          System Environment/Kernel
9 9 
 Vendor:         VMware, Inc.
10 10 
 Distribution:   Photon
11 11 
 Source0:        http://www.kernel.org/pub/linux/kernel/v4.x/linux-%{version}.tar.xz
12 
-%define sha1 linux=ebd02e892297444ea927a45184f10f58fc77dea1
12 
+%define sha1 linux=1f441c2113d0b7bba57dd8f6e5f5db07d222d47b
13 13 
 Source1:        config-secure
14 14 
 Source2:        aufs4.9.tar.gz
15 15 
 %define sha1 aufs=ebe716ce4b638a3772c7cd3161abbfe11d584906
... ... 
@@ -72,22 +72,6 @@ Patch48:        0001-xfs-move-inode-fork-verifiers-to-xfs-dinode-verify.patch
72 72 
 Patch49:        0002-xfs-verify-dinode-header-first.patch
73 73 
 Patch50:        0003-xfs-enhance-dinode-verifier.patch
74 74
75 
-# For Spectre
76 
-Patch52: 0141-locking-barriers-introduce-new-observable-speculatio.patch
77 
-Patch53: 0142-bpf-prevent-speculative-execution-in-eBPF-interprete.patch
78 
-Patch54: 0143-x86-bpf-jit-prevent-speculative-execution-when-JIT-i.patch
79 
-Patch55: 0144-uvcvideo-prevent-speculative-execution.patch
80 
-Patch56: 0145-carl9170-prevent-speculative-execution.patch
81 
-Patch57: 0146-p54-prevent-speculative-execution.patch
82 
-Patch58: 0147-qla2xxx-prevent-speculative-execution.patch
83 
-Patch59: 0148-cw1200-prevent-speculative-execution.patch
84 
-Patch60: 0149-Thermal-int340x-prevent-speculative-execution.patch
85 
-Patch61: 0150-ipv4-prevent-speculative-execution.patch
86 
-Patch62: 0151-ipv6-prevent-speculative-execution.patch
87 
-Patch64: 0153-net-mpls-prevent-speculative-execution.patch
88 
-Patch65: 0154-udf-prevent-speculative-execution.patch
89 
-Patch66: 0155-userns-prevent-speculative-execution.patch
90 
-
91 75 
 Patch70: 0001-fork-unconditionally-clear-stack-on-fork.patch
92 76
93 77 
 # Out-of-tree patches from AppArmor:
... ... 
@@ -216,22 +200,6 @@ EOF
216 216 
 %patch49 -p1
217 217 
 %patch50 -p1
218 218
219 
-# spectre
220 
-%patch52 -p1
221 
-%patch53 -p1
222 
-%patch54 -p1
223 
-%patch55 -p1
224 
-%patch56 -p1
225 
-%patch57 -p1
226 
-%patch58 -p1
227 
-%patch59 -p1
228 
-%patch60 -p1
229 
-%patch61 -p1
230 
-%patch62 -p1
231 
-%patch64 -p1
232 
-%patch65 -p1
233 
-%patch66 -p1
234 
-
235 219 
 %patch70 -p1
236 220
237 221 
 %patch71 -p1
... ... 
@@ -368,6 +336,8 @@ ln -sf linux-%{uname_r}.cfg /boot/photon.cfg
368 368 
 /usr/src/linux-headers-%{uname_r}
369 369
370 370 
 %changelog
371 
+*   Tue Aug 07 2018 Srivatsa S. Bhat <srivatsa@csail.mit.edu> 4.9.118-1
372 
+-   Update to version 4.9.118
371 373 
 *   Mon Jul 30 2018 Srivatsa S. Bhat <srivatsa@csail.mit.edu> 4.9.116-1
372 374 
 -   Update to version 4.9.116 and clear stack on fork.
373 375 
 *   Mon Jul 23 2018 srinidhira0 <srinidhir@vmware.com> 4.9.114-1
SPECS/linux/linux.spec
History View file @ 4f91331
... ... 
@@ -1,7 +1,7 @@
1 1 
 %global security_hardening none
2 2 
 Summary:        Kernel
3 3 
 Name:           linux
4 
-Version:        4.9.116
4 
+Version:        4.9.118
5 5 
 Release:        1%{?kat_build:.%kat_build}%{?dist}
6 6 
 License:    	GPLv2
7 7 
 URL:        	http://www.kernel.org/
... ... 
@@ -9,7 +9,7 @@ Group:        	System Environment/Kernel
9 9 
 Vendor:         VMware, Inc.
10 10 
 Distribution: 	Photon
11 11 
 Source0:        http://www.kernel.org/pub/linux/kernel/v4.x/linux-%{version}.tar.xz
12 
-%define sha1 linux=ebd02e892297444ea927a45184f10f58fc77dea1
12 
+%define sha1 linux=1f441c2113d0b7bba57dd8f6e5f5db07d222d47b
13 13 
 Source1:	config
14 14 
 Source2:	initramfs.trigger
15 15 
 %define ena_version 1.1.3
... ... 
@@ -71,23 +71,6 @@ Patch46:        0001-xfs-move-inode-fork-verifiers-to-xfs-dinode-verify.patch
71 71 
 Patch47:        0002-xfs-verify-dinode-header-first.patch
72 72 
 Patch48:        0003-xfs-enhance-dinode-verifier.patch
73 73
74 
-
75 
-# For Spectre
76 
-Patch52: 0141-locking-barriers-introduce-new-observable-speculatio.patch
77 
-Patch53: 0142-bpf-prevent-speculative-execution-in-eBPF-interprete.patch
78 
-Patch54: 0143-x86-bpf-jit-prevent-speculative-execution-when-JIT-i.patch
79 
-Patch55: 0144-uvcvideo-prevent-speculative-execution.patch
80 
-Patch56: 0145-carl9170-prevent-speculative-execution.patch
81 
-Patch57: 0146-p54-prevent-speculative-execution.patch
82 
-Patch58: 0147-qla2xxx-prevent-speculative-execution.patch
83 
-Patch59: 0148-cw1200-prevent-speculative-execution.patch
84 
-Patch60: 0149-Thermal-int340x-prevent-speculative-execution.patch
85 
-Patch61: 0150-ipv4-prevent-speculative-execution.patch
86 
-Patch62: 0151-ipv6-prevent-speculative-execution.patch
87 
-Patch64: 0153-net-mpls-prevent-speculative-execution.patch
88 
-Patch65: 0154-udf-prevent-speculative-execution.patch
89 
-Patch66: 0155-userns-prevent-speculative-execution.patch
90 
-
91 74 
 Patch70: 0001-fork-unconditionally-clear-stack-on-fork.patch
92 75
93 76 
 # Out-of-tree patches from AppArmor:
... ... 
@@ -209,21 +192,6 @@ This package contains the 'perf' performance analysis tools for Linux kernel.
209 209 
 %patch47 -p1
210 210 
 %patch48 -p1
211 211
212 
-%patch52 -p1
213 
-%patch53 -p1
214 
-%patch54 -p1
215 
-%patch55 -p1
216 
-%patch56 -p1
217 
-%patch57 -p1
218 
-%patch58 -p1
219 
-%patch59 -p1
220 
-%patch60 -p1
221 
-%patch61 -p1
222 
-%patch62 -p1
223 
-%patch64 -p1
224 
-%patch65 -p1
225 
-%patch66 -p1
226 
-
227 212 
 %patch70 -p1
228 213
229 214 
 %patch71 -p1
... ... 
@@ -399,6 +367,8 @@ ln -sf %{name}-%{uname_r}.cfg /boot/photon.cfg
399 399 
 /usr/share/doc/*
400 400
401 401 
 %changelog
402 
+*   Tue Aug 07 2018 Srivatsa S. Bhat <srivatsa@csail.mit.edu> 4.9.118-1
403 
+-   Update to version 4.9.118
402 404 
 *   Mon Jul 30 2018 Srivatsa S. Bhat <srivatsa@csail.mit.edu> 4.9.116-1
403 405 
 -   Update to version 4.9.116 and clear stack on fork.
404 406 
 *   Wed Jul 25 2018 Alexey Makhalov <amakhalov@vmware.com> 4.9.114-2
SPECS/linux/spectre/0141-locking-barriers-introduce-new-observable-speculatio.patch
History View file @ 4f91331
405 407 
deleted file mode 100644
... ... 
@@ -1,62 +0,0 @@
1 
-From 11ea2f142cc668db2383015c722bcd71b6b10ba7 Mon Sep 17 00:00:00 2001
2 
-From: Elena Reshetova <elena.reshetova@intel.com>
3 
-Date: Mon, 7 Aug 2017 11:03:42 +0300
4 
-Subject: [PATCH 141/194] locking/barriers: introduce new observable
5 
- speculation barrier
6 
-
7 
-The new observable speculation barrier, osb(), ensures
8 
-that any user observable speculation doesn't cross the boundary.
9 
-
10 
-Any user observable speculative activity on this CPU
11 
-thread before this point either completes, reaches a
12 
-state it can no longer cause an observable activity, or
13 
-is aborted before instructions after the barrier execute.
14 
-
15 
-In x86 case, osb() resolves in lfence if X86_FEATURE_LFENCE_RDTSC
16 
-is present. Other architectures can define their variants.
17 
-
18 
-Suggested-by: Arjan van de Ven <arjan@linux.intel.com>
19 
-Suggested-by: Alan Cox <alan.cox@intel.com>
20 
-Signed-off-by: Elena Reshetova <elena.reshetova@intel.com>
21 
- arch/x86/include/asm/barrier.h |  2 ++
22 
- include/asm-generic/barrier.h  | 11 +++++++++++
23 
- 2 files changed, 13 insertions(+)
24 
-
25 
-diff --git a/arch/x86/include/asm/barrier.h b/arch/x86/include/asm/barrier.h
26 
-index 01727db..a0f695a 100644
27 
-+++ b/arch/x86/include/asm/barrier.h
28 
-@@ -77,6 +77,8 @@ do {									\
29 
-
30 
- #endif
31 
-
32 
-+#define osb() alternative("", "lfence", X86_FEATURE_LFENCE_RDTSC)
33 
-+
34 
- /* Atomic operations are already serializing on x86 */
35 
- #define __smp_mb__before_atomic()	barrier()
36 
- #define __smp_mb__after_atomic()	barrier()
37 
-diff --git a/include/asm-generic/barrier.h b/include/asm-generic/barrier.h
38 
-index fe297b5..04b3b1f 100644
39 
-+++ b/include/asm-generic/barrier.h
40 
-@@ -246,5 +246,16 @@ do {									\
41 
- })
42 
- #endif
43 
-
44 
-+/* Observable speculation barrier: ensures that any user
45 
-+ * observable speculation doesn't cross the boundary.
46 
-+ * Any user observable speculative activity on this CPU
47 
-+ * thread before this point either completes, reaches a
48 
-+ * state it can no longer cause observable activity, or
49 
-+ * is aborted before instructions after the barrier execute.
50 
-+ */
51 
-+#ifndef osb
52 
-+#define osb()	do { } while (0)
53 
-+#endif
54 
-+
55 
- #endif /* !__ASSEMBLY__ */
56 
- #endif /* __ASM_GENERIC_BARRIER_H */
57 
-2.9.5
58 
-
SPECS/linux/spectre/0142-bpf-prevent-speculative-execution-in-eBPF-interprete.patch
History View file @ 4f91331
59 1 
deleted file mode 100644
... ... 
@@ -1,48 +0,0 @@
1 
-From acc08dc457b9c6b30c21f589ef4f2f5235d1e654 Mon Sep 17 00:00:00 2001
2 
-From: Elena Reshetova <elena.reshetova@intel.com>
3 
-Date: Mon, 7 Aug 2017 11:10:28 +0300
4 
-Subject: [PATCH 142/194] bpf: prevent speculative execution in eBPF
5 
- interpreter
6 
-
7 
-This adds an observable speculation barrier before LD_IMM_DW and
8 
-LDX_MEM_B/H/W/DW eBPF instructions during eBPF program
9 
-execution in order to prevent speculative execution on out
10 
-of bound BFP_MAP array indexes. This way an arbitary kernel
11 
-memory is not exposed through side channel attacks.
12 
-
13 
-Signed-off-by: Elena Reshetova <elena.reshetova@intel.com>
14 
- kernel/bpf/core.c | 3 +++
15 
- 1 file changed, 3 insertions(+)
16 
-
17 
-diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c
18 
-index 7b62df8..b28eca1 100644
19 
-+++ b/kernel/bpf/core.c
20 
-@@ -33,6 +33,7 @@
21 
- #include <linux/frame.h>
22 
-
23 
- #include <asm/unaligned.h>
24 
-+#include <asm/barrier.h>
25 
-
26 
- /* Registers */
27 
- #define BPF_R0	regs[BPF_REG_0]
28 
-@@ -932,6 +933,7 @@ static unsigned int ___bpf_prog_run(u64 *regs, const struct bpf_insn *insn,
29 
- 		DST = IMM;
30 
- 		CONT;
31 
- 	LD_IMM_DW:
32 
-+		osb();
33 
- 		DST = (u64) (u32) insn[0].imm | ((u64) (u32) insn[1].imm) << 32;
34 
- 		insn++;
35 
- 		CONT;
36 
-@@ -1193,6 +1195,7 @@ static unsigned int ___bpf_prog_run(u64 *regs, const struct bpf_insn *insn,
37 
- 		*(SIZE *)(unsigned long) (DST + insn->off) = IMM;	\
38 
- 		CONT;							\
39 
- 	LDX_MEM_##SIZEOP:						\
40 
-+		osb();							\
41 
- 		DST = *(SIZE *)(unsigned long) (SRC + insn->off);	\
42 
- 		CONT;
43 
-
44 
-2.9.5
45 
-
SPECS/linux/spectre/0143-x86-bpf-jit-prevent-speculative-execution-when-JIT-i.patch
History View file @ 4f91331
46 1 
deleted file mode 100644
... ... 
@@ -1,111 +0,0 @@
1 
-From e3b71cad927d33b8e20c66bf07956f935c9c6eef Mon Sep 17 00:00:00 2001
2 
-From: Elena Reshetova <elena.reshetova@intel.com>
3 
-Date: Tue, 8 Aug 2017 12:06:58 +0300
4 
-Subject: [PATCH 143/194] x86, bpf, jit: prevent speculative execution when JIT
5 
- is enabled
6 
-
7 
-When constant blinding is enabled (bpf_jit_harden = 1), this adds
8 
-an observable speculation barrier before emitting x86 jitted code
9 
-for the BPF_ALU(64)_OR_X and BPF_ALU_LHS_X
10 
-(for BPF_REG_AX register) eBPF instructions. This is needed in order
11 
-to prevent speculative execution on out of bounds BPF_MAP array
12 
-indexes when JIT is enabled. This way an arbitary kernel memory is
13 
-not exposed through side-channel attacks.
14 
-
15 
-Signed-off-by: Elena Reshetova <elena.reshetova@intel.com>
16 
- arch/x86/net/bpf_jit_comp.c | 28 +++++++++++++++++++++++++++-
17 
- include/linux/filter.h      |  9 +++++++++
18 
- 2 files changed, 36 insertions(+), 1 deletion(-)
19 
-
20 
-diff --git a/arch/x86/net/bpf_jit_comp.c b/arch/x86/net/bpf_jit_comp.c
21 
-index 0554e8a..f01480a 100644
22 
-+++ b/arch/x86/net/bpf_jit_comp.c
23 
-@@ -16,6 +16,7 @@
24 
- #include <linux/bpf.h>
25 
-
26 
- int bpf_jit_enable __read_mostly;
27 
-+u8 bpf_jit_fence = 0;
28 
-
29 
- /*
30 
-  * assembly code in arch/x86/net/bpf_jit.S
31 
-@@ -109,6 +110,18 @@ static void bpf_flush_icache(void *start, void *end)
32 
- 	set_fs(old_fs);
33 
- }
34 
-
35 
-+static void emit_memory_barrier(u8 **pprog)
36 
-+{
37 
-+	u8 *prog = *pprog;
38 
-+	int cnt = 0;
39 
-+
40 
-+	if (bpf_jit_fence)
41 
-+			EMIT3(0x0f, 0xae, 0xe8);
42 
-+
43 
-+	*pprog = prog;
44 
-+	return;
45 
-+}
46 
-+
47 
- #define CHOOSE_LOAD_FUNC(K, func) \
48 
- 	((int)K < 0 ? ((int)K >= SKF_LL_OFF ? func##_negative_offset : func) : func##_positive_offset)
49 
-
50 
-@@ -400,7 +413,7 @@ static int do_jit(struct bpf_prog *bpf_prog, int *addrs, u8 *image,
51 
- 			case BPF_ADD: b2 = 0x01; break;
52 
- 			case BPF_SUB: b2 = 0x29; break;
53 
- 			case BPF_AND: b2 = 0x21; break;
54 
--			case BPF_OR: b2 = 0x09; break;
55 
-+			case BPF_OR: b2 = 0x09; emit_memory_barrier(&prog); break;
56 
- 			case BPF_XOR: b2 = 0x31; break;
57 
- 			}
58 
- 			if (BPF_CLASS(insn->code) == BPF_ALU64)
59 
-@@ -647,6 +660,16 @@ static int do_jit(struct bpf_prog *bpf_prog, int *addrs, u8 *image,
60 
- 		case BPF_ALU64 | BPF_RSH | BPF_X:
61 
- 		case BPF_ALU64 | BPF_ARSH | BPF_X:
62 
-
63 
-+			/* If blinding is enabled, each
64 
-+			 * BPF_LD | BPF_IMM | BPF_DW instruction
65 
-+			 * is converted to 4 eBPF instructions with
66 
-+			 * BPF_ALU64_IMM(BPF_LSH, BPF_REG_AX, 32)
67 
-+			 * always present(number 3). Detect such cases
68 
-+			 * and insert memory barriers. */
69 
-+			if ((BPF_CLASS(insn->code) == BPF_ALU64)
70 
-+				&& (BPF_OP(insn->code) == BPF_LSH)
71 
-+				&& (src_reg == BPF_REG_AX))
72 
-+				emit_memory_barrier(&prog);
73 
- 			/* check for bad case when dst_reg == rcx */
74 
- 			if (dst_reg == BPF_REG_4) {
75 
- 				/* mov r11, dst_reg */
76 
-@@ -1124,6 +1147,9 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog)
77 
- 	if (!bpf_jit_enable)
78 
- 		return orig_prog;
79 
-
80 
-+	if (bpf_jit_fence_present() && bpf_jit_blinding_enabled())
81 
-+		bpf_jit_fence = 1;
82 
-+
83 
- 	tmp = bpf_jit_blind_constants(prog);
84 
- 	/* If blinding was requested and we failed during blinding,
85 
- 	 * we must fall back to the interpreter.
86 
-diff --git a/include/linux/filter.h b/include/linux/filter.h
87 
-index 48ec57e..cba50a5 100644
88 
-+++ b/include/linux/filter.h
89 
-@@ -651,6 +651,16 @@ static inline bool bpf_jit_blinding_enabled(void)
90 
-
91 
- 	return true;
92 
- }
93 
-+
94 
-+static inline bool bpf_jit_fence_present(void)
95 
-+{
96 
-+	/* Check if lfence is present on CPU
97 
-+	 */
98 
-+	if (boot_cpu_has(X86_FEATURE_LFENCE_RDTSC))
99 
-+		return true;
100 
-+	return false;
101 
-+}
102 
-+
103 
- #else
104 
- static inline void bpf_jit_compile(struct bpf_prog *fp)
105 
- {
106 
-2.9.5
107 
-
SPECS/linux/spectre/0144-uvcvideo-prevent-speculative-execution.patch
History View file @ 4f91331
108 1 
deleted file mode 100644
... ... 
@@ -1,33 +0,0 @@
1 
-From 7dd7ad0b13eb99b650d92ea3b1a2ca170a567216 Mon Sep 17 00:00:00 2001
2 
-From: Elena Reshetova <elena.reshetova@intel.com>
3 
-Date: Wed, 30 Aug 2017 13:41:27 +0300
4 
-Subject: [PATCH 144/194] uvcvideo: prevent speculative execution
5 
-
6 
-Since the index value in function uvc_ioctl_enum_input()
7 
-seems to be controllable by userspace and later on
8 
-conditionally (upon bound check) used to resolve
9 
-selector->baSourceID, insert an observable speculation
10 
-barrier before its usage. This should prevent
11 
-observable speculation on that branch and avoid
12 
-kernel memory leak.
13 
-
14 
-Signed-off-by: Elena Reshetova <elena.reshetova@intel.com>
15 
- drivers/media/usb/uvc/uvc_v4l2.c | 1 +
16 
- 1 file changed, 1 insertion(+)
17 
-
18 
-diff --git a/drivers/media/usb/uvc/uvc_v4l2.c b/drivers/media/usb/uvc/uvc_v4l2.c
19 
-index 3e7e283..65175bb 100644
20 
-+++ b/drivers/media/usb/uvc/uvc_v4l2.c
21 
-@@ -821,6 +821,7 @@ static int uvc_ioctl_enum_input(struct file *file, void *fh,
22 
- 		}
23 
- 		pin = iterm->id;
24 
- 	} else if (index < selector->bNrInPins) {
25 
-+		osb();
26 
- 		pin = selector->baSourceID[index];
27 
- 		list_for_each_entry(iterm, &chain->entities, chain) {
28 
- 			if (!UVC_ENTITY_IS_ITERM(iterm))
29 
-2.9.5
30 
-
SPECS/linux/spectre/0145-carl9170-prevent-speculative-execution.patch
History View file @ 4f91331
31 1 
deleted file mode 100644
... ... 
@@ -1,33 +0,0 @@
1 
-From 9c2549c6adcafe2c2f35d44dc87ec23cc52a68b2 Mon Sep 17 00:00:00 2001
2 
-From: Elena Reshetova <elena.reshetova@intel.com>
3 
-Date: Wed, 30 Aug 2017 13:43:39 +0300
4 
-Subject: [PATCH 145/194] carl9170: prevent speculative execution
5 
-
6 
-Since the queue value in function carl9170_op_conf_tx()
7 
-seems to be controllable by userspace and later on
8 
-conditionally (upon bound check) used to resolve
9 
-ar9170_qmap and following ar->edcf, insert an observable
10 
-speculation barrier before its usage. This should prevent
11 
-observable speculation on that branch and avoid
12 
-kernel memory leak.
13 
-
14 
-Signed-off-by: Elena Reshetova <elena.reshetova@intel.com>
15 
- drivers/net/wireless/ath/carl9170/main.c | 1 +
16 
- 1 file changed, 1 insertion(+)
17 
-
18 
-diff --git a/drivers/net/wireless/ath/carl9170/main.c b/drivers/net/wireless/ath/carl9170/main.c
19 
-index 988c885..cf267b7 100644
20 
-+++ b/drivers/net/wireless/ath/carl9170/main.c
21 
-@@ -1388,6 +1388,7 @@ static int carl9170_op_conf_tx(struct ieee80211_hw *hw,
22 
-
23 
- 	mutex_lock(&ar->mutex);
24 
- 	if (queue < ar->hw->queues) {
25 
-+		osb();
26 
- 		memcpy(&ar->edcf[ar9170_qmap[queue]], param, sizeof(*param));
27 
- 		ret = carl9170_set_qos(ar);
28 
- 	} else {
29 
-2.9.5
30 
-
SPECS/linux/spectre/0146-p54-prevent-speculative-execution.patch
History View file @ 4f91331
31 1 
deleted file mode 100644
... ... 
@@ -1,33 +0,0 @@
1 
-From 07f7bcf24d303ec6d91d7da809f3b6e6760f8301 Mon Sep 17 00:00:00 2001
2 
-From: Elena Reshetova <elena.reshetova@intel.com>
3 
-Date: Wed, 30 Aug 2017 13:44:38 +0300
4 
-Subject: [PATCH 146/194] p54: prevent speculative execution
5 
-
6 
-Since the queue value in function p54_conf_tx()
7 
-seems to be controllable by userspace and later on
8 
-conditionally (upon bound check) used to resolve
9 
-priv->qos_params, insert an observable speculation
10 
-barrier before its usage. This should prevent
11 
-observable speculation on that branch and avoid
12 
-kernel memory leak.
13 
-
14 
-Signed-off-by: Elena Reshetova <elena.reshetova@intel.com>
15 
- drivers/net/wireless/intersil/p54/main.c | 1 +
16 
- 1 file changed, 1 insertion(+)
17 
-
18 
-diff --git a/drivers/net/wireless/intersil/p54/main.c b/drivers/net/wireless/intersil/p54/main.c
19 
-index d5a3bf9..3d20b47 100644
20 
-+++ b/drivers/net/wireless/intersil/p54/main.c
21 
-@@ -415,6 +415,7 @@ static int p54_conf_tx(struct ieee80211_hw *dev,
22 
-
23 
- 	mutex_lock(&priv->conf_mutex);
24 
- 	if (queue < dev->queues) {
25 
-+		osb();
26 
- 		P54_SET_QUEUE(priv->qos_params[queue], params->aifs,
27 
- 			params->cw_min, params->cw_max, params->txop);
28 
- 		ret = p54_set_edcf(priv);
29 
-2.9.5
30 
-
SPECS/linux/spectre/0147-qla2xxx-prevent-speculative-execution.patch
History View file @ 4f91331
31 1 
deleted file mode 100644
... ... 
@@ -1,55 +0,0 @@
1 
-From f7de96128d46f9d9ecad5c1ded3133e2da25f39c Mon Sep 17 00:00:00 2001
2 
-From: Elena Reshetova <elena.reshetova@intel.com>
3 
-Date: Wed, 30 Aug 2017 13:45:35 +0300
4 
-Subject: [PATCH 147/194] qla2xxx: prevent speculative execution
5 
-
6 
-Since the handle value in functions qlafx00_status_entry()
7 
-and qlafx00_multistatus_entry() seems to be controllable
8 
-by userspace and later on conditionally (upon bound check)
9 
-used to resolve req->outstanding_cmds, insert an observable
10 
-speculation barrier before its usage. This should prevent
11 
-observable speculation on that branch and avoid kernel
12 
-memory leak.
13 
-
14 
-Signed-off-by: Elena Reshetova <elena.reshetova@intel.com>
15 
- drivers/scsi/qla2xxx/qla_mr.c | 12 ++++++++----
16 
- 1 file changed, 8 insertions(+), 4 deletions(-)
17 
-
18 
-diff --git a/drivers/scsi/qla2xxx/qla_mr.c b/drivers/scsi/qla2xxx/qla_mr.c
19 
-index e23a3d4..9090283 100644
20 
-+++ b/drivers/scsi/qla2xxx/qla_mr.c
21 
-@@ -2305,10 +2305,12 @@ qlafx00_status_entry(scsi_qla_host_t *vha, struct rsp_que *rsp, void *pkt)
22 
- 	req = ha->req_q_map[que];
23 
-
24 
- 	/* Validate handle. */
25 
--	if (handle < req->num_outstanding_cmds)
26 
-+	if (handle < req->num_outstanding_cmds) {
27 
-+		osb();
28 
- 		sp = req->outstanding_cmds[handle];
29 
--	else
30 
-+	} else {
31 
- 		sp = NULL;
32 
-+	}
33 
-
34 
- 	if (sp == NULL) {
35 
- 		ql_dbg(ql_dbg_io, vha, 0x3034,
36 
-@@ -2656,10 +2658,12 @@ qlafx00_multistatus_entry(struct scsi_qla_host *vha,
37 
- 		req = ha->req_q_map[que];
38 
-
39 
- 		/* Validate handle. */
40 
--		if (handle < req->num_outstanding_cmds)
41 
-+		if (handle < req->num_outstanding_cmds) {
42 
-+			osb();
43 
- 			sp = req->outstanding_cmds[handle];
44 
--		else
45 
-+		} else {
46 
- 			sp = NULL;
47 
-+		}
48 
-
49 
- 		if (sp == NULL) {
50 
- 			ql_dbg(ql_dbg_io, vha, 0x3044,
51 
-2.9.5
52 
-
SPECS/linux/spectre/0148-cw1200-prevent-speculative-execution.patch
History View file @ 4f91331
53 1 
deleted file mode 100644
... ... 
@@ -1,33 +0,0 @@
1 
-From 9a0dc9abad09792c93d099d5e92af5788c224791 Mon Sep 17 00:00:00 2001
2 
-From: Elena Reshetova <elena.reshetova@intel.com>
3 
-Date: Wed, 30 Aug 2017 13:46:21 +0300
4 
-Subject: [PATCH 148/194] cw1200: prevent speculative execution
5 
-
6 
-Since the queue value in function cw1200_conf_tx()
7 
-seems to be controllable by userspace and later on
8 
-conditionally (upon bound check) used in
9 
-WSM_TX_QUEUE_SET, insert an observable speculation
10 
-barrier before its usage. This should prevent
11 
-observable speculation on that branch and avoid
12 
-kernel memory leak.
13 
-
14 
-Signed-off-by: Elena Reshetova <elena.reshetova@intel.com>
15 
- drivers/net/wireless/st/cw1200/sta.c | 1 +
16 
- 1 file changed, 1 insertion(+)
17 
-
18 
-diff --git a/drivers/net/wireless/st/cw1200/sta.c b/drivers/net/wireless/st/cw1200/sta.c
19 
-index a522248..754fc43 100644
20 
-+++ b/drivers/net/wireless/st/cw1200/sta.c
21 
-@@ -619,6 +619,7 @@ int cw1200_conf_tx(struct ieee80211_hw *dev, struct ieee80211_vif *vif,
22 
- 	mutex_lock(&priv->conf_mutex);
23 
-
24 
- 	if (queue < dev->queues) {
25 
-+		osb();
26 
- 		old_uapsd_flags = le16_to_cpu(priv->uapsd_info.uapsd_flags);
27 
-
28 
- 		WSM_TX_QUEUE_SET(&priv->tx_queue_params, queue, 0, 0, 0);
29 
-2.9.5
30 
-
SPECS/linux/spectre/0149-Thermal-int340x-prevent-speculative-execution.patch
History View file @ 4f91331
31 1 
deleted file mode 100644
... ... 
@@ -1,47 +0,0 @@
1 
-From d9542e2d9b4b1e4649f0c1ea13a1b5dcfc1e2674 Mon Sep 17 00:00:00 2001
2 
-From: Elena Reshetova <elena.reshetova@intel.com>
3 
-Date: Wed, 30 Aug 2017 13:47:12 +0300
4 
-Subject: [PATCH 149/194] Thermal/int340x: prevent speculative execution
5 
-
6 
-Since the trip value in function int340x_thermal_get_trip_temp()
7 
-seems to be controllable by userspace and later on
8 
-conditionally (upon bound check) used to resolve
9 
-d->aux_trips, insert an observable speculation
10 
-barrier before its usage. This should prevent
11 
-observable speculation on that branch and avoid
12 
-kernel memory leak.
13 
-
14 
-Signed-off-by: Elena Reshetova <elena.reshetova@intel.com>
15 
- drivers/thermal/int340x_thermal/int340x_thermal_zone.c | 11 ++++++-----
16 
- 1 file changed, 6 insertions(+), 5 deletions(-)
17 
-
18 
-diff --git a/drivers/thermal/int340x_thermal/int340x_thermal_zone.c b/drivers/thermal/int340x_thermal/int340x_thermal_zone.c
19 
-index 145a5c53..d732b34 100644
20 
-+++ b/drivers/thermal/int340x_thermal/int340x_thermal_zone.c
21 
-@@ -57,15 +57,16 @@ static int int340x_thermal_get_trip_temp(struct thermal_zone_device *zone,
22 
- 	if (d->override_ops && d->override_ops->get_trip_temp)
23 
- 		return d->override_ops->get_trip_temp(zone, trip, temp);
24 
-
25 
--	if (trip < d->aux_trip_nr)
26 
-+	if (trip < d->aux_trip_nr) {
27 
-+		osb();
28 
- 		*temp = d->aux_trips[trip];
29 
--	else if (trip == d->crt_trip_id)
30 
-+	} else if (trip == d->crt_trip_id) {
31 
- 		*temp = d->crt_temp;
32 
--	else if (trip == d->psv_trip_id)
33 
-+	} else if (trip == d->psv_trip_id) {
34 
- 		*temp = d->psv_temp;
35 
--	else if (trip == d->hot_trip_id)
36 
-+	} else if (trip == d->hot_trip_id) {
37 
- 		*temp = d->hot_temp;
38 
--	else {
39 
-+	} else {
40 
- 		for (i = 0; i < INT340X_THERMAL_MAX_ACT_TRIP_COUNT; i++) {
41 
- 			if (d->act_trips[i].valid &&
42 
- 			    d->act_trips[i].id == trip) {
43 
-2.9.5
44 
-
SPECS/linux/spectre/0150-ipv4-prevent-speculative-execution.patch
History View file @ 4f91331
45 1 
deleted file mode 100644
... ... 
@@ -1,33 +0,0 @@
1 
-From 9515f43ddd006464308b2796b63b7d6446d922b8 Mon Sep 17 00:00:00 2001
2 
-From: Elena Reshetova <elena.reshetova@intel.com>
3 
-Date: Wed, 13 Dec 2017 10:16:07 +0200
4 
-Subject: [PATCH 150/194] ipv4: prevent speculative execution
5 
-
6 
-Since the offset value in function raw_getfrag()
7 
-seems to be controllable by userspace and later on
8 
-conditionally (upon bound check) used in the following
9 
-memcpy, insert an observable speculation
10 
-barrier before its usage. This should prevent
11 
-observable speculation on that branch and avoid
12 
-kernel memory leak.
13 
-
14 
-Signed-off-by: Elena Reshetova <elena.reshetova@intel.com>
15 
- net/ipv4/raw.c | 1 +
16 
- 1 file changed, 1 insertion(+)
17 
-
18 
-diff --git a/net/ipv4/raw.c b/net/ipv4/raw.c
19 
-index 33b70bf..c9d33f1 100644
20 
-+++ b/net/ipv4/raw.c
21 
-@@ -476,6 +476,7 @@ static int raw_getfrag(void *from, char *to, int offset, int len, int odd,
22 
- 	if (offset < rfv->hlen) {
23 
- 		int copy = min(rfv->hlen - offset, len);
24 
-
25 
-+		osb();
26 
- 		if (skb->ip_summed == CHECKSUM_PARTIAL)
27 
- 			memcpy(to, rfv->hdr.c + offset, copy);
28 
- 		else
29 
-2.9.5
30 
-
SPECS/linux/spectre/0151-ipv6-prevent-speculative-execution.patch
History View file @ 4f91331
31 1 
deleted file mode 100644
... ... 
@@ -1,33 +0,0 @@
1 
-From 1ce83a2cfe57cec87a22e69b726e9547b4d830f8 Mon Sep 17 00:00:00 2001
2 
-From: Elena Reshetova <elena.reshetova@intel.com>
3 
-Date: Wed, 30 Aug 2017 13:48:35 +0300
4 
-Subject: [PATCH 151/194] ipv6: prevent speculative execution
5 
-
6 
-Since the offset value in function raw6_getfrag()
7 
-seems to be controllable by userspace and later on
8 
-conditionally (upon bound check) used in the
9 
-following memcpy, insert an observable speculation
10 
-barrier before its usage. This should prevent
11 
-observable speculation on that branch and avoid
12 
-kernel memory leak.
13 
-
14 
-Signed-off-by: Elena Reshetova <elena.reshetova@intel.com>
15 
- net/ipv6/raw.c | 1 +
16 
- 1 file changed, 1 insertion(+)
17 
-
18 
-diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c
19 
-index e4462b0..8794d92 100644
20 
-+++ b/net/ipv6/raw.c
21 
-@@ -729,6 +729,7 @@ static int raw6_getfrag(void *from, char *to, int offset, int len, int odd,
22 
- 	if (offset < rfv->hlen) {
23 
- 		int copy = min(rfv->hlen - offset, len);
24 
-
25 
-+		osb();
26 
- 		if (skb->ip_summed == CHECKSUM_PARTIAL)
27 
- 			memcpy(to, rfv->c + offset, copy);
28 
- 		else
29 
-2.9.5
30 
-
SPECS/linux/spectre/0153-net-mpls-prevent-speculative-execution.patch
History View file @ 4f91331
31 1 
deleted file mode 100644
... ... 
@@ -1,34 +0,0 @@
1 
-From 3e9a34c67e5376bedd9e79e6a7e16b01a01c8215 Mon Sep 17 00:00:00 2001
2 
-From: Elena Reshetova <elena.reshetova@intel.com>
3 
-Date: Wed, 30 Aug 2017 13:55:54 +0300
4 
-Subject: [PATCH 153/194] net: mpls: prevent speculative execution
5 
-
6 
-Since the index value in function mpls_route_input_rcu()
7 
-seems to be controllable by userspace and later on
8 
-conditionally (upon bound check) used to resolve
9 
-platform_label, insert an observable speculation
10 
-barrier before its usage. This should prevent
11 
-observable speculation on that branch and avoid
12 
-kernel memory leak.
13 
-
14 
-Signed-off-by: Elena Reshetova <elena.reshetova@intel.com>
15 
- net/mpls/af_mpls.c | 2 ++
16 
- 1 file changed, 2 insertions(+)
17 
-
18 
-diff --git a/net/mpls/af_mpls.c b/net/mpls/af_mpls.c
19 
-index c5b9ce4..3bdf8d8 100644
20 
-+++ b/net/mpls/af_mpls.c
21 
-@@ -50,6 +50,8 @@ static struct mpls_route *mpls_route_input_rcu(struct net *net, unsigned index)
22 
- 	if (index < net->mpls.platform_labels) {
23 
- 		struct mpls_route __rcu **platform_label =
24 
- 			rcu_dereference(net->mpls.platform_label);
25 
-+
26 
-+		osb();
27 
- 		rt = rcu_dereference(platform_label[index]);
28 
- 	}
29 
- 	return rt;
30 
-2.9.5
31 
-
SPECS/linux/spectre/0154-udf-prevent-speculative-execution.patch
History View file @ 4f91331
32 1 
deleted file mode 100644
... ... 
@@ -1,52 +0,0 @@
1 
-From bbb72371d2212fe0526f1ae679d5d55fe51bd909 Mon Sep 17 00:00:00 2001
2 
-From: Elena Reshetova <elena.reshetova@intel.com>
3 
-Date: Wed, 13 Dec 2017 10:15:30 +0200
4 
-Subject: [PATCH 154/194] udf: prevent speculative execution
5 
-
6 
-Since the eahd->appAttrLocation value in function
7 
-udf_add_extendedattr() seems to be controllable by
8 
-userspace and later on conditionally (upon bound check)
9 
-used in following memmove, insert an observable speculation
10 
-barrier before its usage. This should prevent
11 
-observable speculation on that branch and avoid
12 
-kernel memory leak.
13 
-
14 
-Signed-off-by: Elena Reshetova <elena.reshetova@intel.com>
15 
- fs/udf/misc.c | 6 ++++++
16 
- 1 file changed, 6 insertions(+)
17 
-
18 
-diff --git a/fs/udf/misc.c b/fs/udf/misc.c
19 
-index 3949c4b..c826ccc 100644
20 
-+++ b/fs/udf/misc.c
21 
-@@ -104,6 +104,8 @@ struct genericFormat *udf_add_extendedattr(struct inode *inode, uint32_t size,
22 
- 					iinfo->i_lenEAttr) {
23 
- 				uint32_t aal =
24 
- 					le32_to_cpu(eahd->appAttrLocation);
25 
-+
26 
-+				osb();
27 
- 				memmove(&ea[offset - aal + size],
28 
- 					&ea[aal], offset - aal);
29 
- 				offset -= aal;
30 
-@@ -114,6 +116,8 @@ struct genericFormat *udf_add_extendedattr(struct inode *inode, uint32_t size,
31 
- 					iinfo->i_lenEAttr) {
32 
- 				uint32_t ial =
33 
- 					le32_to_cpu(eahd->impAttrLocation);
34 
-+
35 
-+				osb();
36 
- 				memmove(&ea[offset - ial + size],
37 
- 					&ea[ial], offset - ial);
38 
- 				offset -= ial;
39 
-@@ -125,6 +129,8 @@ struct genericFormat *udf_add_extendedattr(struct inode *inode, uint32_t size,
40 
- 					iinfo->i_lenEAttr) {
41 
- 				uint32_t aal =
42 
- 					le32_to_cpu(eahd->appAttrLocation);
43 
-+
44 
-+				osb();
45 
- 				memmove(&ea[offset - aal + size],
46 
- 					&ea[aal], offset - aal);
47 
- 				offset -= aal;
48 
-2.9.5
49 
-
SPECS/linux/spectre/0155-userns-prevent-speculative-execution.patch
History View file @ 4f91331
50 1 
deleted file mode 100644
... ... 
@@ -1,39 +0,0 @@
1 
-From 616abca9e7f1add8e8f26cf6d33992b76412bcec Mon Sep 17 00:00:00 2001
2 
-From: Tim Chen <tim.c.chen@linux.intel.com>
3 
-Date: Fri, 15 Dec 2017 02:29:09 -0800
4 
-Subject: [PATCH 155/194] userns: prevent speculative execution
5 
-
6 
-From: Elena Reshetova <elena.reshetova@intel.com>
7 
-
8 
-Since the pos value in function m_start()
9 
-seems to be controllable by userspace and later on
10 
-conditionally (upon bound check) used to resolve
11 
-map->extent, insert an observable speculation
12 
-barrier before its usage. This should prevent
13 
-observable speculation on that branch and avoid
14 
-kernel memory leak.
15 
-
16 
-Signed-off-by: Elena Reshetova <elena.reshetova@intel.com>
17 
- kernel/user_namespace.c | 4 +++-
18 
- 1 file changed, 3 insertions(+), 1 deletion(-)
19 
-
20 
-diff --git a/kernel/user_namespace.c b/kernel/user_namespace.c
21 
-index c490f1e..2240f36 100644
22 
-+++ b/kernel/user_namespace.c
23 
-@@ -543,8 +543,10 @@ static void *m_start(struct seq_file *seq, loff_t *ppos,
24 
- 	struct uid_gid_extent *extent = NULL;
25 
- 	loff_t pos = *ppos;
26 
-
27 
--	if (pos < map->nr_extents)
28 
-+	if (pos < map->nr_extents) {
29 
-+		osb();
30 
- 		extent = &map->extent[pos];
31 
-+	}
32 
-
33 
- 	return extent;
34 
- }
35 
-2.9.5
36 
-