| From bippy-5f407fcff5a0 Mon Sep 17 00:00:00 2001 |
| From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| To: <linux-cve-announce@vger.kernel.org> |
| Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org> |
| Subject: CVE-2021-46990: powerpc/64s: Fix crashes when toggling entry flush barrier |
| |
| Description |
| =========== |
| |
| In the Linux kernel, the following vulnerability has been resolved: |
| |
| powerpc/64s: Fix crashes when toggling entry flush barrier |
| |
| The entry flush mitigation can be enabled/disabled at runtime via a |
| debugfs file (entry_flush), which causes the kernel to patch itself to |
| enable/disable the relevant mitigations. |
| |
| However depending on which mitigation we're using, it may not be safe to |
| do that patching while other CPUs are active. For example the following |
| crash: |
| |
| sleeper[15639]: segfault (11) at c000000000004c20 nip c000000000004c20 lr c000000000004c20 |
| |
| Shows that we returned to userspace with a corrupted LR that points into |
| the kernel, due to executing the partially patched call to the fallback |
| entry flush (ie. we missed the LR restore). |
| |
| Fix it by doing the patching under stop machine. The CPUs that aren't |
| doing the patching will be spinning in the core of the stop machine |
| logic. That is currently sufficient for our purposes, because none of |
| the patching we do is to that code or anywhere in the vicinity. |
| |
| The Linux kernel CVE team has assigned CVE-2021-46990 to this issue. |
| |
| |
| Affected and fixed versions |
| =========================== |
| |
| Issue introduced in 4.4.245 with commit 4a1e90af718d1489ffcecc8f52486c4f5dc0f7a6 and fixed in 4.4.269 with commit 8382b15864e5014261b4f36c2aa89723612ee058 |
| Issue introduced in 4.9.245 with commit fa4bf9f38184ed7ca4916eb64f8c767d1e279c1f and fixed in 4.9.269 with commit 0c25a7bb697f2e6ee65b6d63782f675bf129511a |
| Issue introduced in 4.14.208 with commit db01cad9efe3c3838a6b3a3f68affd295c4b92d6 and fixed in 4.14.233 with commit ee4b7aab93c2631c3bb0753023c5dda592bb666b |
| Issue introduced in 4.19.159 with commit f69bb4e51f41973fb7594be1479fa689831efe1a and fixed in 4.19.191 with commit 2db22ba4e0e103f00e0512e0ecce36ac78c644f8 |
| Issue introduced in 5.4.79 with commit b65458b6be8032c5179d4f562038575d7b3a6be3 and fixed in 5.4.120 with commit 0b4eb172cc12dc102cd0ad013e53ee4463db9508 |
| Issue introduced in 5.10 with commit f79643787e0a0762d2409b7b8334e83f22d85695 and fixed in 5.10.38 with commit d2e3590ca39ccfd8a5a46d8c7f095cb6c7b9ae92 |
| Issue introduced in 5.10 with commit f79643787e0a0762d2409b7b8334e83f22d85695 and fixed in 5.11.22 with commit dd0d6117052faace5440db20fc37175efe921c7d |
| Issue introduced in 5.10 with commit f79643787e0a0762d2409b7b8334e83f22d85695 and fixed in 5.12.5 with commit 5bc00fdda1e934c557351a9c751a205293e68cbf |
| Issue introduced in 5.10 with commit f79643787e0a0762d2409b7b8334e83f22d85695 and fixed in 5.13 with commit aec86b052df6541cc97c5fca44e5934cbea4963b |
| Issue introduced in 5.9.10 with commit e590b36718d6e740b7b19514f710402a6499164c |
| |
| Please see https://www.kernel.org for a full list of currently supported |
| kernel versions by the kernel community. |
| |
| Unaffected versions might change over time as fixes are backported to |
| older supported kernel versions. The official CVE entry at |
| https://cve.org/CVERecord/?id=CVE-2021-46990 |
| will be updated if fixes are backported, please check that for the most |
| up to date information about this issue. |
| |
| |
| Affected files |
| ============== |
| |
| The file(s) affected by this issue are: |
| arch/powerpc/lib/feature-fixups.c |
| |
| |
| Mitigation |
| ========== |
| |
| The Linux kernel CVE team recommends that you update to the latest |
| stable kernel version for this, and many other bugfixes. Individual |
| changes are never tested alone, but rather are part of a larger kernel |
| release. Cherry-picking individual commits is not recommended or |
| supported by the Linux kernel community at all. If however, updating to |
| the latest release is impossible, the individual changes to resolve this |
| issue can be found at these commits: |
| https://git.kernel.org/stable/c/8382b15864e5014261b4f36c2aa89723612ee058 |
| https://git.kernel.org/stable/c/0c25a7bb697f2e6ee65b6d63782f675bf129511a |
| https://git.kernel.org/stable/c/ee4b7aab93c2631c3bb0753023c5dda592bb666b |
| https://git.kernel.org/stable/c/2db22ba4e0e103f00e0512e0ecce36ac78c644f8 |
| https://git.kernel.org/stable/c/0b4eb172cc12dc102cd0ad013e53ee4463db9508 |
| https://git.kernel.org/stable/c/d2e3590ca39ccfd8a5a46d8c7f095cb6c7b9ae92 |
| https://git.kernel.org/stable/c/dd0d6117052faace5440db20fc37175efe921c7d |
| https://git.kernel.org/stable/c/5bc00fdda1e934c557351a9c751a205293e68cbf |
| https://git.kernel.org/stable/c/aec86b052df6541cc97c5fca44e5934cbea4963b |
