diff --git a/debian/changelog b/debian/changelog index a14dc8004..95b314575 100644 --- a/debian/changelog +++ b/debian/changelog @@ -245,6 +245,8 @@ linux (3.16.7-ckt2-1) UNRELEASED; urgency=medium * [amd64] traps: Stop using IST for #SS (CVE-2014-9090) * [amd64] traps: Fix the espfix64 #DF fixup and rewrite it in C * [amd64] traps: Rework bad_iret + * [amd64] asm/traps: Disable tracing and kprobes in fixup_bad_iret and + sync_regs * Fix ABI changes in iovec, of, perf and truncate * Ignore ABI changes in iwlwifi, KVM and spi-nor * Revert "drivers/net: Disable UFO through virtio" in macvtap and tun. diff --git a/debian/patches/bugfix/x86/x86-asm-traps-Disable-tracing-and-kprobes-in-fixup_b.patch b/debian/patches/bugfix/x86/x86-asm-traps-Disable-tracing-and-kprobes-in-fixup_b.patch new file mode 100644 index 000000000..cfd521066 --- /dev/null +++ b/debian/patches/bugfix/x86/x86-asm-traps-Disable-tracing-and-kprobes-in-fixup_b.patch @@ -0,0 +1,50 @@ +From: Andy Lutomirski +Date: Mon, 24 Nov 2014 17:39:06 -0800 +Subject: x86/asm/traps: Disable tracing and kprobes in fixup_bad_iret and + sync_regs +Origin: https://git.kernel.org/cgit/linux/kernel/git/tip/tip.git/commit?id=7ddc6a2199f1da405a2fb68c40db8899b1a8cd87 + +These functions can be executed on the int3 stack, so kprobes +are dangerous. Tracing is probably a bad idea, too. + +Fixes: b645af2d5905 ("x86_64, traps: Rework bad_iret") +Signed-off-by: Andy Lutomirski +Cc: # Backport as far back as it would apply +Cc: Linus Torvalds +Cc: Steven Rostedt +Link: http://lkml.kernel.org/r/50e33d26adca60816f3ba968875801652507d0c4.1416870125.git.luto@amacapital.net +Signed-off-by: Ingo Molnar +--- + arch/x86/kernel/traps.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/arch/x86/kernel/traps.c b/arch/x86/kernel/traps.c +index de801f2..07ab8e9 100644 +--- a/arch/x86/kernel/traps.c ++++ b/arch/x86/kernel/traps.c +@@ -387,7 +387,7 @@ NOKPROBE_SYMBOL(do_int3); + * for scheduling or signal handling. The actual stack switch is done in + * entry.S + */ +-asmlinkage __visible struct pt_regs *sync_regs(struct pt_regs *eregs) ++asmlinkage __visible notrace struct pt_regs *sync_regs(struct pt_regs *eregs) + { + struct pt_regs *regs = eregs; + /* Did already sync */ +@@ -413,7 +413,7 @@ struct bad_iret_stack { + struct pt_regs regs; + }; + +-asmlinkage __visible ++asmlinkage __visible notrace + struct bad_iret_stack *fixup_bad_iret(struct bad_iret_stack *s) + { + /* +@@ -436,6 +436,7 @@ struct bad_iret_stack *fixup_bad_iret(struct bad_iret_stack *s) + BUG_ON(!user_mode_vm(&new_stack->regs)); + return new_stack; + } ++NOKPROBE_SYMBOL(fixup_bad_iret); + #endif + + /* diff --git a/debian/patches/series b/debian/patches/series index f15af53ee..4c7661511 100644 --- a/debian/patches/series +++ b/debian/patches/series @@ -62,6 +62,7 @@ bugfix/arm64/arm64-removed-using-of-the-mask-attribute-in-the-dts.patch bugfix/x86/x86_64-traps-Stop-using-IST-for-SS.patch bugfix/x86/x86_64-traps-Fix-the-espfix64-DF-fixup-and-rewrite-i.patch bugfix/x86/x86_64-traps-Rework-bad_iret.patch +bugfix/x86/x86-asm-traps-Disable-tracing-and-kprobes-in-fixup_b.patch # Arch features features/mips/MIPS-Support-hard-limit-of-cpu-count-nr_cpu_ids.patch