[PATCH 6.6 v2 0/7] x86: fix user address masking non-canonical

[Jimmy Tran <jtoantran@google.com>]

Hi everyone,

This is v2 of my series to backport the critical security fix,
identified as CVE-2020-12965 ("Transient Execution of Non-Canonical Accesses"),
to the 6.6.y stable kernel tree.

Linus Torvalds's second proposed solution offers a more targeted and
smaller backport for CVE-2020-12965 compared to backporting the entire
patch series.

 This alternative would focus solely on the user address masking
 logic that addresses the AMD speculation issue with non-canonical
 addresses.

 Instead of introducing the extensive "runtime-constant"
 infrastructure seen in the larger patch series, this solution would:

  - Introduce a single new variable for the USER_PTR_MAX
    value.
  - Use an actual memory load to access this USER_PTR_MAX value, rather than
    leveraging the runtime_const mechanism.

 While this approach would result in a noticeably smaller and more
 localized patch, it would differ from what's currently in the
 mainline kernel. This divergence would necessitate significant
 additional testing to ensure its stability.

I am ready to implement the second proposed solution if the
maintainers wish to move forward in that direction, understanding the
testing implications. Please let me know your preference.

Changes in v2:
==============
- Incorporated the commit 91309a708: x86: use cmov for user address
  as suggested by David Laight. This commit is now included as the first patch
  in the series.

This series addresses the CVE-2020-12965 vulnerability by
introducing the necessary x86 infrastructure and the specific fix for user
address masking non-canonical speculation issues.

v1:
==============
This patch series backports a critical security fix, identified as
CVE-2020-12965 ("Transient Execution of Non-Canonical Accesses"), to the
6.6.y stable kernel tree.

David Laight (1):
  x86: fix off-by-one in access_ok()

Linus Torvalds (6):
  vfs: dcache: move hashlen_hash() from callers into d_hash()
  runtime constants: add default dummy infrastructure
  runtime constants: add x86 architecture support
  arm64: add 'runtime constant' support
  x86: fix user address masking non-canonical speculation issue
  x86: use cmov for user address masking

 arch/arm64/include/asm/runtime-const.h | 92 ++++++++++++++++++++++++++
 arch/arm64/kernel/vmlinux.lds.S        |  3 +
 arch/x86/include/asm/runtime-const.h   | 61 +++++++++++++++++
 arch/x86/include/asm/uaccess_64.h      | 44 +++++++-----
 arch/x86/kernel/cpu/common.c           | 10 +++
 arch/x86/kernel/vmlinux.lds.S          |  4 ++
 arch/x86/lib/getuser.S                 | 10 ++-
 fs/dcache.c                            | 17 +++--
 include/asm-generic/Kbuild             |  1 +
 include/asm-generic/runtime-const.h    | 15 +++++
 include/asm-generic/vmlinux.lds.h      |  8 +++
 11 files changed, 242 insertions(+), 23 deletions(-)
 create mode 100644 arch/arm64/include/asm/runtime-const.h
 create mode 100644 arch/x86/include/asm/runtime-const.h
 create mode 100644 include/asm-generic/runtime-const.h

-- 
2.50.1.470.g6ba607880d-goog