linux-stable.git/arch/arm/kernel, branch v4.14.78

ARM: oabi-compat: copy semops using __copy_from_user()

2018-10-18T07:16:28+00:00

Commit 8c8484a1c18e3231648f5ba7cc5ffb7fd70b3ca4 upstream.

__get_user_error() is used as a fast accessor to make copying structure
members as efficient as possible.  However, with software PAN and the
recent Spectre variant 1, the efficiency is reduced as these are no
longer fast accessors.

In the case of software PAN, it has to switch the domain register around
each access, and with Spectre variant 1, it would have to repeat the
access_ok() check for each access.

Rather than using __get_user_error() to copy each semops element member,
copy each semops element in full using __copy_from_user().

Acked-by: Mark Rutland 
Signed-off-by: Russell King 
Signed-off-by: David A. Long 
Signed-off-by: Greg Kroah-Hartman

ARM: vfp: use __copy_from_user() when restoring VFP state

2018-10-18T07:16:28+00:00

Commit 42019fc50dfadb219f9e6ddf4c354f3837057d80 upstream.

__get_user_error() is used as a fast accessor to make copying structure
members in the signal handling path as efficient as possible.  However,
with software PAN and the recent Spectre variant 1, the efficiency is
reduced as these are no longer fast accessors.

In the case of software PAN, it has to switch the domain register around
each access, and with Spectre variant 1, it would have to repeat the
access_ok() check for each access.

Use __copy_from_user() rather than __get_user_err() for individual
members when restoring VFP state.

Acked-by: Mark Rutland 
Signed-off-by: Russell King 
Signed-off-by: David A. Long 
Signed-off-by: Greg Kroah-Hartman

ARM: signal: copy registers using __copy_from_user()

2018-10-18T07:16:27+00:00

Commit c32cd419d6650e42b9cdebb83c672ec945e6bd7e upstream.

__get_user_error() is used as a fast accessor to make copying structure
members in the signal handling path as efficient as possible.  However,
with software PAN and the recent Spectre variant 1, the efficiency is
reduced as these are no longer fast accessors.

In the case of software PAN, it has to switch the domain register around
each access, and with Spectre variant 1, it would have to repeat the
access_ok() check for each access.

It becomes much more efficient to use __copy_from_user() instead, so
let's use this for the ARM integer registers.

Acked-by: Mark Rutland 
Signed-off-by: Russell King 
Signed-off-by: David A. Long 
Signed-off-by: Greg Kroah-Hartman

ARM: spectre-v1: fix syscall entry

2018-10-18T07:16:27+00:00

Commit 10573ae547c85b2c61417ff1a106cffbfceada35 upstream.

Prevent speculation at the syscall table decoding by clamping the index
used to zero on invalid system call numbers, and using the csdb
speculative barrier.

Signed-off-by: Russell King 
Acked-by: Mark Rutland 
Boot-tested-by: Tony Lindgren 
Reviewed-by: Tony Lindgren 
Signed-off-by: David A. Long 
Signed-off-by: Greg Kroah-Hartman

ARM: bugs: add support for per-processor bug checking

2018-10-18T07:16:26+00:00

Commit 9d3a04925deeabb97c8e26d940b501a2873e8af3 upstream.

Add support for per-processor bug checking - each processor function
descriptor gains a function pointer for this check, which must not be
an __init function.  If non-NULL, this will be called whenever a CPU
enters the kernel via which ever path (boot CPU, secondary CPU startup,
CPU resuming, etc.)

This allows processor specific bug checks to validate that workaround
bits are properly enabled by firmware via all entry paths to the kernel.

Signed-off-by: Russell King 
Reviewed-by: Florian Fainelli 
Boot-tested-by: Tony Lindgren 
Reviewed-by: Tony Lindgren 
Acked-by: Marc Zyngier 
Signed-off-by: David A. Long 
Signed-off-by: Greg Kroah-Hartman

ARM: bugs: hook processor bug checking into SMP and suspend paths

2018-10-18T07:16:26+00:00

Commit 26602161b5ba795928a5a719fe1d5d9f2ab5c3ef upstream.

Check for CPU bugs when secondary processors are being brought online,
and also when CPUs are resuming from a low power mode.  This gives an
opportunity to check that processor specific bug workarounds are
correctly enabled for all paths that a CPU re-enters the kernel.

Signed-off-by: Russell King 
Reviewed-by: Florian Fainelli 
Boot-tested-by: Tony Lindgren 
Reviewed-by: Tony Lindgren 
Acked-by: Marc Zyngier 
Signed-off-by: David A. Long 
Signed-off-by: Greg Kroah-Hartman

ARM: bugs: prepare processor bug infrastructure

2018-10-18T07:16:26+00:00

Commit a5b9177f69329314721aa7022b7e69dab23fa1f0 upstream.

Prepare the processor bug infrastructure so that it can be expanded to
check for per-processor bugs.

Signed-off-by: Russell King 
Reviewed-by: Florian Fainelli 
Boot-tested-by: Tony Lindgren 
Reviewed-by: Tony Lindgren 
Acked-by: Marc Zyngier 
Signed-off-by: David A. Long 
Signed-off-by: Greg Kroah-Hartman

ARM: kexec: fix kdump register saving on panic()

2018-06-20T19:03:01+00:00

[ Upstream commit 2d7b3c64431245c95b05a441669c074da10db943 ]

When a panic() occurs, the kexec code uses smp_send_stop() to stop
the other CPUs, but this results in the CPU register state not being
saved, and gdb is unable to inspect the state of other CPUs.

Commit 0ee59413c967 ("x86/panic: replace smp_send_stop() with kdump
friendly version in panic path") addressed the issue on x86, but
ignored other architectures.  Address the issue on ARM by splitting
out the crash stop implementation to crash_smp_send_stop() and
adding the necessary protection.

Signed-off-by: Russell King 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman

ARM: 8748/1: mm: Define vdso_start, vdso_end as array

2018-05-30T05:52:20+00:00

[ Upstream commit 73b9160d0dfe44dfdaffd6465dc1224c38a4a73c ]

Define vdso_start, vdso_end as array to avoid compile-time analysis error
for the case of built with CONFIG_FORTIFY_SOURCE.

and, since vdso_start, vdso_end are used in vdso.c only,
move extern-declaration from vdso.h to vdso.c.

If kernel is built with CONFIG_FORTIFY_SOURCE,
compile-time error happens at this code.
- if (memcmp(&vdso_start, "177ELF", 4))

The size of "&vdso_start" is recognized as 1 byte, but n is 4,
So that compile-time error is reported.

Acked-by: Kees Cook 
Signed-off-by: Jinbum Park 
Signed-off-by: Russell King 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman

ARM: 8771/1: kprobes: Prohibit kprobes on do_undefinstr

2018-05-22T16:54:00+00:00

commit eb0146daefdde65665b7f076fbff7b49dade95b9 upstream.

Prohibit kprobes on do_undefinstr because kprobes on
arm is implemented by undefined instruction. This means
if we probe do_undefinstr(), it can cause infinit
recursive exception.

Fixes: 24ba613c9d6c ("ARM kprobes: core code")
Signed-off-by: Masami Hiramatsu 
Cc: stable@vger.kernel.org
Signed-off-by: Russell King 
Signed-off-by: Greg Kroah-Hartman