From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail-yb0-f200.google.com (mail-yb0-f200.google.com [209.85.213.200]) by kanga.kvack.org (Postfix) with ESMTP id 06F6C6B0005 for ; Thu, 2 Aug 2018 18:22:06 -0400 (EDT) Received: by mail-yb0-f200.google.com with SMTP id t14-v6so2815548ybb.0 for ; Thu, 02 Aug 2018 15:22:06 -0700 (PDT) Received: from mail-sor-f65.google.com (mail-sor-f65.google.com. [209.85.220.65]) by mx.google.com with SMTPS id b14-v6sor786634ybm.84.2018.08.02.15.22.04 for (Google Transport Security); Thu, 02 Aug 2018 15:22:04 -0700 (PDT) MIME-Version: 1.0 In-Reply-To: References: <153156030832.10043.13438231886571087086.stgit@srivatsa-ubuntu> From: Kees Cook Date: Thu, 2 Aug 2018 15:22:01 -0700 Message-ID: Subject: Re: [RESEND] Spectre-v2 (IBPB/IBRS) and SSBD fixes for 4.4.y Content-Type: text/plain; charset="UTF-8" Sender: owner-linux-mm@kvack.org List-ID: To: "Srivatsa S. Bhat" Cc: Jiri Kosina , Greg KH , "# 3.4.x" , Denys Vlasenko , Bo Gan , Konrad Rzeszutek Wilk , Borislav Petkov , Thomas Gleixner , Ricardo Neri , Tom Lendacky , Andi Kleen , linux-tip-commits@vger.kernel.org, Jia Zhang , Josh Poimboeuf , xen-devel , =?UTF-8?B?S3LEjW3DocWZ?= , Peter Zijlstra , Andy Lutomirski , Arnaldo Carvalho de Melo , Sherry Hurwitz , LKML , Shuah Khan , Oleg Nesterov , Linus Torvalds , David Woodhouse , KarimAllah Ahmed , Borislav Petkov , Dave Hansen , Dominik Brodowski , Quentin Casasnovas , Joerg Roedel , Alexander Shishkin , Kyle Huey , Will Drewry , Andrey Ryabinin , "H. Peter Anvin" , Brian Gerst , Kristen Carlson Accardi , Thomas Garnier , Andrew Morton , Joe Konno , kvm , Piotr Luc , Boris Ostrovsky , Jan Beulich , Arjan van de Ven , Alexander Kuleshov , Juergen Gross , Ross Zwisler , =?UTF-8?Q?J=C3=B6rg_Otte?= , Tim Chen , Alexander Sergeyev , Josh Triplett , Alan Cox , Tony Luck , Laura Abbott , Dave Hansen , Ingo Molnar , Mike Galbraith , Rik van Riel , "Kirill A. Shutemov" , Alexey Makhalov , Dave Hansen , ashok.raj@intel.com, Mel Gorman , =?UTF-8?B?TWlja2HDq2xTYWxhw7xu?= , Fenghua Yu , "Matt Helsley (VMware)" , Vince Weaver , Prarit Bhargava , Steven Rostedt , Dan Williams , Jim Mattson , Greg Kroah-Hartmann , Dave Young , linux-edac , Jon Masters , Andy Lutomirski , Paolo Bonzini , Arnd Bergmann , Linux-MM , Jiri Olsa , "Van De Ven, Arjan" , sironi@amazon.de, Frederic Weisbecker , Kyle Huey , Alexander Popov , Andy Shevchenko , Nadav Amit , Yazen Ghannam , Wanpeng Li , Stephane Eranian , David Woodhouse , srivatsab@vmware.com, srinidhir@vmware.com On Thu, Aug 2, 2018 at 12:22 PM, Srivatsa S. Bhat wrote: > On 7/26/18 4:09 PM, Kees Cook wrote: >> On Tue, Jul 24, 2018 at 3:02 PM, Jiri Kosina wrote: >>> On Tue, 24 Jul 2018, Srivatsa S. Bhat wrote: >>> >>>> However, if you are proposing that you'd like to contribute the enhanced >>>> PTI/Spectre (upstream) patches from the SLES 4.4 tree to 4.4 stable, and >>>> have them merged instead of this patch series, then I would certainly >>>> welcome it! >>> >>> I'd in principle love us to push everything back to 4.4, but there are a >>> few reasons (*) why that's not happening shortly. >>> >>> Anyway, to point out explicitly what's really needed for those folks >>> running 4.4-stable and relying on PTI providing The Real Thing(TM), it's >>> either a 4.4-stable port of >>> >>> http://kernel.suse.com/cgit/kernel-source/plain/patches.suse/x86-entry-64-use-a-per-cpu-trampoline-stack.patch?id=3428a77b02b1ba03e45d8fc352ec350429f57fc7 >>> >>> or making THREADINFO_GFP imply __GFP_ZERO. >> >> This is true in Linus's tree now. Should be trivial to backport: >> https://git.kernel.org/linus/e01e80634ecdd >> > > Hi Jiri, Kees, > > Thank you for suggesting the patch! I have attached the (locally > tested) 4.4 and 4.9 backports of that patch with this mail. (The > mainline commit applies cleanly on 4.14). > > Greg, could you please consider including them in stable 4.4, 4.9 > and 4.14? I don't think your v4.9 is sufficient: it leaves the vmapped stack uncleared. v4.9 needs ca182551857 ("kmemleak: clear stale pointers from task stacks") included in the backport (really, just adding the memset()). Otherwise, yup, looks good. -Kees -- Kees Cook Pixel Security