|
| 1 | +diff --git a/Makefile b/Makefile |
| 2 | +index 7878fd783212d0..d00b00f0c54fcb 100644 |
| 3 | +--- a/Makefile |
| 4 | ++++ b/Makefile |
| 5 | +@@ -1,7 +1,7 @@ |
| 6 | + # SPDX-License-Identifier: GPL-2.0 |
| 7 | + VERSION = 6 |
| 8 | + PATCHLEVEL = 6 |
| 9 | +-SUBLEVEL = 138 |
| 10 | ++SUBLEVEL = 139 |
| 11 | + EXTRAVERSION = |
| 12 | + NAME = Pinguïn Aangedreven |
| 13 | + |
| 14 | +diff --git a/arch/x86/include/asm/msr-index.h b/arch/x86/include/asm/msr-index.h |
| 15 | +index deb5fe00177630..c9f83af0e0b784 100644 |
| 16 | +--- a/arch/x86/include/asm/msr-index.h |
| 17 | ++++ b/arch/x86/include/asm/msr-index.h |
| 18 | +@@ -675,6 +675,7 @@ |
| 19 | + /* Zen4 */ |
| 20 | + #define MSR_ZEN4_BP_CFG 0xc001102e |
| 21 | + #define MSR_ZEN4_BP_CFG_SHARED_BTB_FIX_BIT 5 |
| 22 | ++#define MSR_ZEN2_BP_CFG_BUG_FIX_BIT 33 |
| 23 | + |
| 24 | + /* Zen 2 */ |
| 25 | + #define MSR_ZEN2_SPECTRAL_CHICKEN 0xc00110e3 |
| 26 | +diff --git a/arch/x86/kernel/cpu/amd.c b/arch/x86/kernel/cpu/amd.c |
| 27 | +index 211141d37d1555..c5bcf438483060 100644 |
| 28 | +--- a/arch/x86/kernel/cpu/amd.c |
| 29 | ++++ b/arch/x86/kernel/cpu/amd.c |
| 30 | +@@ -1166,6 +1166,9 @@ static void init_amd_zen2(struct cpuinfo_x86 *c) |
| 31 | + msr_clear_bit(MSR_AMD64_CPUID_FN_7, 18); |
| 32 | + pr_emerg("RDSEED is not reliable on this platform; disabling.\n"); |
| 33 | + } |
| 34 | ++ |
| 35 | ++ if (!cpu_has(c, X86_FEATURE_HYPERVISOR)) |
| 36 | ++ msr_set_bit(MSR_ZEN4_BP_CFG, MSR_ZEN2_BP_CFG_BUG_FIX_BIT); |
| 37 | + } |
| 38 | + |
| 39 | + static void init_amd_zen3(struct cpuinfo_x86 *c) |
| 40 | +diff --git a/include/linux/sched.h b/include/linux/sched.h |
| 41 | +index 9c7c67efce346f..856a560100c23e 100644 |
| 42 | +--- a/include/linux/sched.h |
| 43 | ++++ b/include/linux/sched.h |
| 44 | +@@ -916,6 +916,9 @@ struct task_struct { |
| 45 | + */ |
| 46 | + unsigned sched_remote_wakeup:1; |
| 47 | + |
| 48 | ++ /* Save user-dumpable when mm goes away */ |
| 49 | ++ unsigned user_dumpable:1; |
| 50 | ++ |
| 51 | + /* Bit to tell LSMs we're in execve(): */ |
| 52 | + unsigned in_execve:1; |
| 53 | + unsigned in_iowait:1; |
| 54 | +diff --git a/kernel/exit.c b/kernel/exit.c |
| 55 | +index 03a1dd32e6ff3c..686bbe72bb41ad 100644 |
| 56 | +--- a/kernel/exit.c |
| 57 | ++++ b/kernel/exit.c |
| 58 | +@@ -559,6 +559,7 @@ static void exit_mm(void) |
| 59 | + */ |
| 60 | + smp_mb__after_spinlock(); |
| 61 | + local_irq_disable(); |
| 62 | ++ current->user_dumpable = (get_dumpable(mm) == SUID_DUMP_USER); |
| 63 | + current->mm = NULL; |
| 64 | + membarrier_update_current_mm(NULL); |
| 65 | + enter_lazy_tlb(mm, current); |
| 66 | +diff --git a/kernel/ptrace.c b/kernel/ptrace.c |
| 67 | +index 443057bee87cb7..3c7d122a37fb4c 100644 |
| 68 | +--- a/kernel/ptrace.c |
| 69 | ++++ b/kernel/ptrace.c |
| 70 | +@@ -283,11 +283,24 @@ static bool ptrace_has_cap(struct user_namespace *ns, unsigned int mode) |
| 71 | + return ns_capable(ns, CAP_SYS_PTRACE); |
| 72 | + } |
| 73 | + |
| 74 | ++static bool task_still_dumpable(struct task_struct *task, unsigned int mode) |
| 75 | ++{ |
| 76 | ++ struct mm_struct *mm = task->mm; |
| 77 | ++ if (mm) { |
| 78 | ++ if (get_dumpable(mm) == SUID_DUMP_USER) |
| 79 | ++ return true; |
| 80 | ++ return ptrace_has_cap(mm->user_ns, mode); |
| 81 | ++ } |
| 82 | ++ |
| 83 | ++ if (task->user_dumpable) |
| 84 | ++ return true; |
| 85 | ++ return ptrace_has_cap(&init_user_ns, mode); |
| 86 | ++} |
| 87 | ++ |
| 88 | + /* Returns 0 on success, -errno on denial. */ |
| 89 | + static int __ptrace_may_access(struct task_struct *task, unsigned int mode) |
| 90 | + { |
| 91 | + const struct cred *cred = current_cred(), *tcred; |
| 92 | +- struct mm_struct *mm; |
| 93 | + kuid_t caller_uid; |
| 94 | + kgid_t caller_gid; |
| 95 | + |
| 96 | +@@ -348,11 +361,8 @@ ok: |
| 97 | + * Pairs with a write barrier in commit_creds(). |
| 98 | + */ |
| 99 | + smp_rmb(); |
| 100 | +- mm = task->mm; |
| 101 | +- if (mm && |
| 102 | +- ((get_dumpable(mm) != SUID_DUMP_USER) && |
| 103 | +- !ptrace_has_cap(mm->user_ns, mode))) |
| 104 | +- return -EPERM; |
| 105 | ++ if (!task_still_dumpable(task, mode)) |
| 106 | ++ return -EPERM; |
| 107 | + |
| 108 | + return security_ptrace_access_check(task, mode); |
| 109 | + } |
| 110 | +diff --git a/tools/arch/x86/include/asm/msr-index.h b/tools/arch/x86/include/asm/msr-index.h |
| 111 | +index 76f9cad9fb62b1..d108bc6634ed4d 100644 |
| 112 | +--- a/tools/arch/x86/include/asm/msr-index.h |
| 113 | ++++ b/tools/arch/x86/include/asm/msr-index.h |
| 114 | +@@ -638,6 +638,9 @@ |
| 115 | + /* AMD Last Branch Record MSRs */ |
| 116 | + #define MSR_AMD64_LBR_SELECT 0xc000010e |
| 117 | + |
| 118 | ++#define MSR_ZEN4_BP_CFG 0xc001102e |
| 119 | ++#define MSR_ZEN2_BP_CFG_BUG_FIX_BIT 33 |
| 120 | ++ |
| 121 | + /* Fam 17h MSRs */ |
| 122 | + #define MSR_F17H_IRPERF 0xc00000e9 |
| 123 | + |
0 commit comments