Hi Greg,
To fix CVE-2020-29372 in COS kernel versions 4.19 and 5.4, we
cherry-picked the commit "mm: check that mm is still valid in
madvise()" (bc0c4d1e176e) that Jens introduced in kernel version 5.7.0
into our kernel sources. The commit is small and the cherry-pick was
successful for both COS kernels versions.
Because COS 4.19 and 5.4 kernels track 4.19.y and 5.4.y respectively,
can you please cherry-pick the commit to those stable branches?
Thanks,
--Saied
COS kernel source: https://cos.googlesource.com/third_party/kernel
When enabled, the MMX 3DNow! optimized memcpy() is used very early,
even before FPU is initialized. It worked fine, but commit
7ad816762f9bf89e940e618ea40c43138b479e10 ("x86/fpu: Reset MXCSR
to default in kernel_fpu_begin()") broke that. After that commit
the kernel crashes just after "Booting the kernel." message.
It affects all kernels with CONFIG_X86_USE_3DNOW=y (enabled when
some AMD/Cyrix processors are selected). So, enable MMX 3DNow!
optimized memcpy() later.
Cc: <stable(a)vger.kernel.org> # 5.8+
Signed-off-by: Krzysztof Mazur <krzysiek(a)podlesie.net>
---
Hi,
this patch fixes a kernel crash during boot observed on AMD Athlon XP
(with CONFIG_MK7=y).
The static key adds 5 byte NOP in the "fast" path. The 3DNow! usage
can be enabled earlier, but arch_initcall should be ok.
The static_cpu_has() does not work because the kernel with
CONFIG_X86_USE_3DNOW=y assumes that 3DNOW! is available,
so a static key is used instead. "Alternatives" should
also work, as long they not assume that required features
(REQUIRED_MASK*) are available early.
Similar bugs are possible. For easier debugging, maybe
kernel_fpu_begin() should catch such cases and print something?
Thanks,
Krzysiek
arch/x86/lib/mmx_32.c | 12 +++++++++++-
1 file changed, 11 insertions(+), 1 deletion(-)
diff --git a/arch/x86/lib/mmx_32.c b/arch/x86/lib/mmx_32.c
index 4321fa02e18d..375bf0798993 100644
--- a/arch/x86/lib/mmx_32.c
+++ b/arch/x86/lib/mmx_32.c
@@ -26,12 +26,14 @@
#include <asm/fpu/api.h>
#include <asm/asm.h>
+static __ro_after_init DEFINE_STATIC_KEY_FALSE(use_mmx);
+
void *_mmx_memcpy(void *to, const void *from, size_t len)
{
void *p;
int i;
- if (unlikely(in_interrupt()))
+ if (unlikely(in_interrupt()) || !static_branch_likely(&use_mmx))
return __memcpy(to, from, len);
p = to;
@@ -376,3 +378,11 @@ void mmx_copy_page(void *to, void *from)
fast_copy_page(to, from);
}
EXPORT_SYMBOL(mmx_copy_page);
+
+static int __init mmx_32_init(void)
+{
+ static_branch_enable(&use_mmx);
+ return 0;
+}
+
+arch_initcall(mmx_32_init);
--
2.27.0.rc1.207.gb85828341f