From 11cce6895251319892c96b5e4df48f84d5ad3b98 Mon Sep 17 00:00:00 2001 From: David Michael Date: Mon, 6 Aug 2018 17:51:18 +0000 Subject: [PATCH] sys-kernel/coreos-sources: Bump 4.17.12 to 4.17.13 --- ...r1.ebuild => coreos-kernel-4.17.13.ebuild} | 2 +- ...1.ebuild => coreos-modules-4.17.13.ebuild} | 2 +- .../sys-kernel/coreos-sources/Manifest | 2 +- ...1.ebuild => coreos-sources-4.17.13.ebuild} | 1 - ...lative-path-for-KBUILD_SRC-from-CURD.patch | 6 +- .../z0002-Add-arm64-coreos-verity-hash.patch | 4 +- ...kefile-Don-t-fail-on-fallthrough-wit.patch | 4 +- ...t-due-to-x86-boot-compressed-64-Hand.patch | 4 +- ...ove-ebx-handling-from-error_entry-ex.patch | 133 ------------------ 9 files changed, 12 insertions(+), 146 deletions(-) rename sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-kernel/{coreos-kernel-4.17.12-r1.ebuild => coreos-kernel-4.17.13.ebuild} (99%) rename sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/{coreos-modules-4.17.12-r1.ebuild => coreos-modules-4.17.13.ebuild} (98%) rename sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/{coreos-sources-4.17.12-r1.ebuild => coreos-sources-4.17.13.ebuild} (94%) delete mode 100644 sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/4.17/z0005-x86-entry-64-Remove-ebx-handling-from-error_entry-ex.patch diff --git a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-kernel/coreos-kernel-4.17.12-r1.ebuild b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-kernel/coreos-kernel-4.17.13.ebuild similarity index 99% rename from sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-kernel/coreos-kernel-4.17.12-r1.ebuild rename to sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-kernel/coreos-kernel-4.17.13.ebuild index b66d13b93c..77eaa0bc62 100644 --- a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-kernel/coreos-kernel-4.17.12-r1.ebuild +++ b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-kernel/coreos-kernel-4.17.13.ebuild @@ -2,7 +2,7 @@ # Distributed under the terms of the GNU General Public License v2 EAPI=5 -COREOS_SOURCE_REVISION="-r1" +COREOS_SOURCE_REVISION="" inherit coreos-kernel DESCRIPTION="CoreOS Linux kernel" diff --git a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/coreos-modules-4.17.12-r1.ebuild b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/coreos-modules-4.17.13.ebuild similarity index 98% rename from sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/coreos-modules-4.17.12-r1.ebuild rename to sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/coreos-modules-4.17.13.ebuild index 6c70281dca..685aa802e6 100644 --- a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/coreos-modules-4.17.12-r1.ebuild +++ b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/coreos-modules-4.17.13.ebuild @@ -2,7 +2,7 @@ # Distributed under the terms of the GNU General Public License v2 EAPI=5 -COREOS_SOURCE_REVISION="-r1" +COREOS_SOURCE_REVISION="" inherit coreos-kernel savedconfig DESCRIPTION="CoreOS Linux kernel modules" diff --git a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/Manifest b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/Manifest index b16c6dd4e7..338f246ff9 100644 --- a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/Manifest +++ b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/Manifest @@ -1,4 +1,4 @@ DIST linux-4.14.tar.xz 100770500 SHA256 f81d59477e90a130857ce18dc02f4fbe5725854911db1e7ba770c7cd350f96a7 SHA512 77e43a02d766c3d73b7e25c4aafb2e931d6b16e870510c22cef0cdb05c3acb7952b8908ebad12b10ef982c6efbe286364b1544586e715cf38390e483927904d8 WHIRLPOOL fee10d54ecb210156aa55364ecc15867127819e9f7ff9ec5f6ef159b1013e2ae3d3a28d35c62d663886cbe826b996a1387671766093be002536309045a8e4d10 DIST linux-4.17.tar.xz 102165892 SHA256 9faa1dd896eaea961dc6e886697c0b3301277102e5bc976b2758f9a62d3ccd13 SHA512 4d9de340a26155a89ea8773131c76220cc2057f2b5d031b467b60e8b14c1842518e2d60a863d8c695f0f7640f3f18d43826201984a238dade857b6cef79837db WHIRLPOOL 60573a6837a5daae91ea8d36f7aea0439a398d47810524df378b37df20ebb6fa83d518380348ec66cfe8f94b2405de59f884d52ac879cb4ff78f6674ad322077 DIST patch-4.14.60.xz 1559132 SHA256 4cca9c6dfc779dff6dbefa5b7dea8874eb76f0131ab271b7d2f9d1d627d84b88 SHA512 884975454aac5cb69dcb0db68ab05a41a51f8ca9da7bf27bc012ef65b1020a71ed661feed80a9b9ee94b32bfc55bc9c563e0acb1023da46a3240565816673b4b WHIRLPOOL b8c1b2189936cb79cd2771f53e4dda4b6465dcaea8c3261760e0d3fccfd5dbe8c124c42ef54459eded39c77313180c142dfb8ab7087dfdc459cb4fd8a4e3d3e5 -DIST patch-4.17.12.xz 322464 SHA256 6ed482aa6bb72999434ca34de3081e798d4fc0ac79ec3e57af3a98927348ff99 SHA512 516270daaa65a0f40bf6202909fc1950a8c723b77d5a54089a72eb664c3708ece050c938230cdd3b1b3e281d73c1c5e909def5fe1e0c8ddecbf9fbd43713a3aa WHIRLPOOL 83d6eb3fbeacca1e3cc063925641de75e61df92599a73d4bbba65427092dea4c56a0e3f2adbd58eec03ec5be071a856f83e81bcd1e3b4da28ae6192de3b41c7a +DIST patch-4.17.13.xz 329540 SHA256 5dbfce6d7ea2118919f98493136a9d8c7a09b87e11c2f7d66556d2d4127aff5c SHA512 8f77239c6c0393aa6e854f98d0ef0832e0a3e936251805ca1fcde2b5d24e0b086582f68e3f494a4a287b404573c26a867170958d53f3c1bf4c46c4c5697188b2 WHIRLPOOL 76fad83c04dba67db402f21e95a6960f03f3ca0fac204d04d43e3fc818c9bb82062ade65f2ce9e746067037e10b4d77688effd42117b8fd8703afbd1941d470a diff --git a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/coreos-sources-4.17.12-r1.ebuild b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/coreos-sources-4.17.13.ebuild similarity index 94% rename from sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/coreos-sources-4.17.12-r1.ebuild rename to sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/coreos-sources-4.17.13.ebuild index 82fdef9e03..fda167a8ac 100644 --- a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/coreos-sources-4.17.12-r1.ebuild +++ b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/coreos-sources-4.17.13.ebuild @@ -39,5 +39,4 @@ UNIPATCH_LIST=" ${PATCH_DIR}/z0002-Add-arm64-coreos-verity-hash.patch \ ${PATCH_DIR}/z0003-tools-objtool-Makefile-Don-t-fail-on-fallthrough-wit.patch \ ${PATCH_DIR}/z0004-4.17.x-won-t-boot-due-to-x86-boot-compressed-64-Hand.patch \ - ${PATCH_DIR}/z0005-x86-entry-64-Remove-ebx-handling-from-error_entry-ex.patch \ " diff --git a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/4.17/z0001-kbuild-derive-relative-path-for-KBUILD_SRC-from-CURD.patch b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/4.17/z0001-kbuild-derive-relative-path-for-KBUILD_SRC-from-CURD.patch index 197dadabe2..7b26b9a379 100644 --- a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/4.17/z0001-kbuild-derive-relative-path-for-KBUILD_SRC-from-CURD.patch +++ b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/4.17/z0001-kbuild-derive-relative-path-for-KBUILD_SRC-from-CURD.patch @@ -1,7 +1,7 @@ -From 1565054e3925885a5a727c59145485eb928b65c8 Mon Sep 17 00:00:00 2001 +From 0ed694cd4354a9c32f4d352bfab431a2b9d494d2 Mon Sep 17 00:00:00 2001 From: Vito Caputo Date: Wed, 25 Nov 2015 02:59:45 -0800 -Subject: [PATCH 1/5] kbuild: derive relative path for KBUILD_SRC from CURDIR +Subject: [PATCH 1/4] kbuild: derive relative path for KBUILD_SRC from CURDIR This enables relocating source and build trees to different roots, provided they stay reachable relative to one another. Useful for @@ -12,7 +12,7 @@ by some undesirable path component. 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/Makefile b/Makefile -index 790e8faf0ddc..780b8757cd8d 100644 +index 2534e51de1db..ffda2668f9d6 100644 --- a/Makefile +++ b/Makefile @@ -143,7 +143,8 @@ $(filter-out _all sub-make $(CURDIR)/Makefile, $(MAKECMDGOALS)) _all: sub-make diff --git a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/4.17/z0002-Add-arm64-coreos-verity-hash.patch b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/4.17/z0002-Add-arm64-coreos-verity-hash.patch index 2f764c949d..7ec7d93636 100644 --- a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/4.17/z0002-Add-arm64-coreos-verity-hash.patch +++ b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/4.17/z0002-Add-arm64-coreos-verity-hash.patch @@ -1,7 +1,7 @@ -From d1a996e00fc7b58bfffc3cfcd807c9dde2949634 Mon Sep 17 00:00:00 2001 +From 110966b0617ebb45d2161523fbc60bac075b11aa Mon Sep 17 00:00:00 2001 From: Geoff Levand Date: Fri, 11 Nov 2016 17:28:52 -0800 -Subject: [PATCH 2/5] Add arm64 coreos verity hash +Subject: [PATCH 2/4] Add arm64 coreos verity hash Signed-off-by: Geoff Levand --- diff --git a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/4.17/z0003-tools-objtool-Makefile-Don-t-fail-on-fallthrough-wit.patch b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/4.17/z0003-tools-objtool-Makefile-Don-t-fail-on-fallthrough-wit.patch index 7346c569fe..ab55ad8089 100644 --- a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/4.17/z0003-tools-objtool-Makefile-Don-t-fail-on-fallthrough-wit.patch +++ b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/4.17/z0003-tools-objtool-Makefile-Don-t-fail-on-fallthrough-wit.patch @@ -1,7 +1,7 @@ -From 178edc68fcd926a894972ea889b5265428fdc5ac Mon Sep 17 00:00:00 2001 +From b1549d2ddae4a6eee1e36ac45fdb26bd6be0d0f0 Mon Sep 17 00:00:00 2001 From: David Michael Date: Thu, 8 Feb 2018 21:23:12 -0500 -Subject: [PATCH 3/5] tools/objtool/Makefile: Don't fail on fallthrough with +Subject: [PATCH 3/4] tools/objtool/Makefile: Don't fail on fallthrough with new GCCs --- diff --git a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/4.17/z0004-4.17.x-won-t-boot-due-to-x86-boot-compressed-64-Hand.patch b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/4.17/z0004-4.17.x-won-t-boot-due-to-x86-boot-compressed-64-Hand.patch index f47d4f5aeb..973ab61393 100644 --- a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/4.17/z0004-4.17.x-won-t-boot-due-to-x86-boot-compressed-64-Hand.patch +++ b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/4.17/z0004-4.17.x-won-t-boot-due-to-x86-boot-compressed-64-Hand.patch @@ -1,7 +1,7 @@ -From 61ceb2881ae20ce661b4cc28cf7369bfccae9086 Mon Sep 17 00:00:00 2001 +From 83e720dae3d730f010a2d4ff9776d7a9f1dbb155 Mon Sep 17 00:00:00 2001 From: "Kirill A. Shutemov" Date: Wed, 4 Jul 2018 18:08:57 +0300 -Subject: [PATCH 4/5] 4.17.x won't boot due to "x86/boot/compressed/64: Handle +Subject: [PATCH 4/4] 4.17.x won't boot due to "x86/boot/compressed/64: Handle 5-level paging boot if kernel is above 4G" On Tue, Jul 03, 2018 at 05:21:50PM +0300, Kirill A. Shutemov wrote: diff --git a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/4.17/z0005-x86-entry-64-Remove-ebx-handling-from-error_entry-ex.patch b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/4.17/z0005-x86-entry-64-Remove-ebx-handling-from-error_entry-ex.patch deleted file mode 100644 index 49b64677d1..0000000000 --- a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/4.17/z0005-x86-entry-64-Remove-ebx-handling-from-error_entry-ex.patch +++ /dev/null @@ -1,133 +0,0 @@ -From c9017bec96f9cdd3c9434b44e0d28da2c8573b47 Mon Sep 17 00:00:00 2001 -From: Andy Lutomirski -Date: Sun, 22 Jul 2018 11:05:09 -0700 -Subject: [PATCH 5/5] x86/entry/64: Remove %ebx handling from error_entry/exit - -error_entry and error_exit communicate the user vs. kernel status of -the frame using %ebx. This is unnecessary -- the information is in -regs->cs. Just use regs->cs. - -This makes error_entry simpler and makes error_exit more robust. - -It also fixes a nasty bug. Before all the Spectre nonsense, the -xen_failsafe_callback entry point returned like this: - - ALLOC_PT_GPREGS_ON_STACK - SAVE_C_REGS - SAVE_EXTRA_REGS - ENCODE_FRAME_POINTER - jmp error_exit - -And it did not go through error_entry. This was bogus: RBX -contained garbage, and error_exit expected a flag in RBX. - -Fortunately, it generally contained *nonzero* garbage, so the -correct code path was used. As part of the Spectre fixes, code was -added to clear RBX to mitigate certain speculation attacks. Now, -depending on kernel configuration, RBX got zeroed and, when running -some Wine workloads, the kernel crashes. This was introduced by: - - commit 3ac6d8c787b8 ("x86/entry/64: Clear registers for exceptions/interrupts, to reduce speculation attack surface") - -With this patch applied, RBX is no longer needed as a flag, and the -problem goes away. - -I suspect that malicious userspace could use this bug to crash the -kernel even without the offending patch applied, though. - -[ Historical note: I wrote this patch as a cleanup before I was aware - of the bug it fixed. ] - -[ Note to stable maintainers: this should probably get applied to all - kernels. If you're nervous about that, a more conservative fix to - add xorl %ebx,%ebx; incl %ebx before the jump to error_exit should - also fix the problem. ] - -Reported-and-tested-by: M. Vefa Bicakci -Signed-off-by: Andy Lutomirski -Cc: Boris Ostrovsky -Cc: Borislav Petkov -Cc: Brian Gerst -Cc: Dave Hansen -Cc: Denys Vlasenko -Cc: Dominik Brodowski -Cc: Greg KH -Cc: H. Peter Anvin -Cc: Josh Poimboeuf -Cc: Juergen Gross -Cc: Linus Torvalds -Cc: Peter Zijlstra -Cc: Thomas Gleixner -Cc: stable@vger.kernel.org -Cc: xen-devel@lists.xenproject.org -Fixes: 3ac6d8c787b8 ("x86/entry/64: Clear registers for exceptions/interrupts, to reduce speculation attack surface") -Link: http://lkml.kernel.org/r/b5010a090d3586b2d6e06c7ad3ec5542d1241c45.1532282627.git.luto@kernel.org -Signed-off-by: Ingo Molnar ---- - arch/x86/entry/entry_64.S | 18 ++++-------------- - 1 file changed, 4 insertions(+), 14 deletions(-) - -diff --git a/arch/x86/entry/entry_64.S b/arch/x86/entry/entry_64.S -index 3166b9674429..b9699e63ceda 100644 ---- a/arch/x86/entry/entry_64.S -+++ b/arch/x86/entry/entry_64.S -@@ -981,7 +981,7 @@ ENTRY(\sym) - - call \do_sym - -- jmp error_exit /* %ebx: no swapgs flag */ -+ jmp error_exit - .endif - END(\sym) - .endm -@@ -1222,7 +1222,6 @@ END(paranoid_exit) - - /* - * Save all registers in pt_regs, and switch GS if needed. -- * Return: EBX=0: came from user mode; EBX=1: otherwise - */ - ENTRY(error_entry) - UNWIND_HINT_FUNC -@@ -1269,7 +1268,6 @@ ENTRY(error_entry) - * for these here too. - */ - .Lerror_kernelspace: -- incl %ebx - leaq native_irq_return_iret(%rip), %rcx - cmpq %rcx, RIP+8(%rsp) - je .Lerror_bad_iret -@@ -1303,28 +1301,20 @@ ENTRY(error_entry) - - /* - * Pretend that the exception came from user mode: set up pt_regs -- * as if we faulted immediately after IRET and clear EBX so that -- * error_exit knows that we will be returning to user mode. -+ * as if we faulted immediately after IRET. - */ - mov %rsp, %rdi - call fixup_bad_iret - mov %rax, %rsp -- decl %ebx - jmp .Lerror_entry_from_usermode_after_swapgs - END(error_entry) - -- --/* -- * On entry, EBX is a "return to kernel mode" flag: -- * 1: already in kernel mode, don't need SWAPGS -- * 0: user gsbase is loaded, we need SWAPGS and standard preparation for return to usermode -- */ - ENTRY(error_exit) - UNWIND_HINT_REGS - DISABLE_INTERRUPTS(CLBR_ANY) - TRACE_IRQS_OFF -- testl %ebx, %ebx -- jnz retint_kernel -+ testb $3, CS(%rsp) -+ jz retint_kernel - jmp retint_user - END(error_exit) - --- -2.17.1 -