linux-kernel - arm64 spectre-bhb backports break boot on stable kernels <= v5.4

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20220408120041.GB27685@willie-the-truck>
Date:   Fri, 8 Apr 2022 13:00:41 +0100
From:   Will Deacon <will@...nel.org>
To:     linux-arm-kernel@...ts.infradead.org, james.morse@....com
Cc:     linux-kernel@...r.kernel.org, gregkh@...uxfoundation.org,
        maz@...nel.org, catalin.marinas@....com, mark.rutland@....com
Subject: arm64 spectre-bhb backports break boot on stable kernels <= v5.4

Hi James,

Booting stable kernels <= v5.4 on arm64 with CONFIG_HARDEN_BRANCH_PREDICTOR=n
results in a NULL pointer dereference during boot due to kvm_get_hyp_vector()
dereferencing a NULL pointer from arm64_get_bp_hardening_data():

[    2.384444] Internal error: Oops: 96000004 [#1] PREEMPT SMP
[    2.384461] pstate: 20400085 (nzCv daIf +PAN -UAO)
[    2.384472] pc : cpu_hyp_reinit+0x114/0x30c
[    2.384476] lr : cpu_hyp_reinit+0x80/0x30c
[    2.384477] sp : ffff800010013e20
[    2.384479] x29: ffff800010013e20 x28: ffff0000df033f00
[    2.384484] x27: ffff800011caa000 x26: ffff0000de58e000
[    2.384487] x25: ffff800011e57000 x24: ffff800011caad90
[    2.384490] x23: ffff800011c778e0 x22: ffff800011a56000
[    2.384494] x21: ffff800011a56000 x20: 0000b471121a6000
[    2.384497] x19: 00000000de588000 x18: 0000000000000000
[    2.384500] x17: 0000000000000000 x16: 0000000000000400
[    2.384503] x15: 0000000000001000 x14: 00000000000007f2
[    2.384507] x13: 0000000000000004 x12: 0000000000000002
[    2.384510] x11: 0000000000000000 x10: 00000000121a6000
[    2.384513] x9 : ffff800011c77fd8 x8 : 0000000000000010
[    2.384516] x7 : 4f422effff306b64 x6 : 0000008080000000
[    2.384519] x5 : 0000008080000000 x4 : ffff800011fabc94
[    2.384522] x3 : ffff800011f5bde0 x2 : 0000000000000001
[    2.384526] x1 : 00000000121a0000 x0 : ffff8000118f962d
[    2.384529] Call trace:
[    2.384533]  cpu_hyp_reinit+0x114/0x30c
[    2.384537]  _kvm_arch_hardware_enable+0x30/0x54
[    2.384541]  flush_smp_call_function_queue+0xe4/0x154
[    2.384544]  generic_smp_call_function_single_interrupt+0x10/0x18
[    2.384549]  ipi_handler+0x170/0x2b0
[    2.384555]  handle_percpu_devid_fasteoi_ipi+0x120/0x1cc
[    2.384560]  __handle_domain_irq+0x9c/0xf4
[    2.384563]  gic_handle_irq+0x6c/0xe4
[    2.384566]  el1_irq+0xf0/0x1c0
[    2.384570]  arch_cpu_idle+0x28/0x44
[    2.384574]  do_idle+0x100/0x2a8
[    2.384577]  cpu_startup_entry+0x20/0x24
[    2.384581]  secondary_start_kernel+0x1b0/0x1cc
[    2.384589] Code: b9469d08 7100011f 540003ad 52800208 (f9400108)
[    2.384600] ---[ end trace 266d08dbf96ff143 ]---
[    2.385171] Kernel panic - not syncing: Fatal exception in interrupt

The faulting load is the access to 'data->template_start', for which the
compiler emits the hilarious:

	mov	w8, #0x10
	ldr	x8, [x8]

I can bodge this as below (untested), but it's pretty grotty. Please can you
take a look?

Cheers,

Will

--->8

diff --git a/arch/arm64/kernel/cpu_errata.c b/arch/arm64/kernel/cpu_errata.c
index 33b33416fea4..3bc1380f5524 100644
--- a/arch/arm64/kernel/cpu_errata.c
+++ b/arch/arm64/kernel/cpu_errata.c
@@ -939,6 +939,7 @@ const struct arm64_cpu_capabilities arm64_errata[] = {
                .cpu_enable = cpu_enable_ssbd_mitigation,
                .midr_range_list = arm64_ssb_cpus,
        },
+#ifdef CONFIG_HARDEN_BRANCH_PREDICTOR
        {
                .desc = "Spectre-BHB",
                .capability = ARM64_SPECTRE_BHB,
@@ -946,6 +947,7 @@ const struct arm64_cpu_capabilities arm64_errata[] = {
                .matches = is_spectre_bhb_affected,
                .cpu_enable = spectre_bhb_enable_mitigation,
        },
+#endif
 #ifdef CONFIG_ARM64_ERRATUM_1418040
        {
                .desc = "ARM erratum 1418040",