Now when peeling off an association to the sock in another netns, all
transports in this assoc are not to be rehashed and keep use the old
key in hashtable.

As a transport uses sk->net as the hash key to insert into hashtable,
it would miss removing these transports from hashtable due to the new
netns when closing the sock and all transports are being freeed, then
later an use-after-free issue could be caused when looking up an asoc
and dereferencing those transports.

This is a very old issue since very beginning, ChunYu found it with
syzkaller fuzz testing with this series:

  socket$inet6_sctp()
  bind$inet6()
  sendto$inet6()
  unshare(0x40000000)
  getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST()
  getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF()

This patch is to block this call when peeling one assoc off from one
netns to another one, so that the netns of all transport would not
go out-sync with the key in hashtable.

Note that this patch didn't fix it by rehashing transports, as it's
difficult to handle the situation when the tuple is already in use
in the new netns. Besides, no one would like to peel off one assoc
to another netns, considering ipaddrs, ifaces, etc. are usually
different.
Reported-by: ChunYu Wang <chunwang@redhat.com>
Signed-off-by: Xin Long <lucien.xin@gmail.com>
Acked-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Acked-by: Neil Horman <nhorman@tuxdriver.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

CVE-2017-15115
(cherry picked from commit df80cd9b)
Signed-off-by: Kleber Sacilotto de Souza <kleber.souza@canonical.com>
Acked-by: Colin Ian King <colin.king@canonical.com>
Acked-by: Stefan Bader <stefan.bader@canonical.com>
Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@canonical.com>

Whenever the sock object is in DCCP_CLOSED state,
dccp_disconnect() must free dccps_hc_tx_ccid and
dccps_hc_rx_ccid and set to NULL.
Signed-off-by: Mohamed Ghannam <simo.ghannam@gmail.com>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

CVE-2017-8824
(cherry picked from commit 69c64866 linux-next)
Signed-off-by: Kleber Sacilotto de Souza <kleber.souza@canonical.com>
Acked-by: Seth Forshee <seth.forshee@canonical.com>
Acked-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@canonical.com>

Ignore: yes
Signed-off-by: Stefan Bader <stefan.bader@canonical.com>

Signed-off-by: Stefan Bader <stefan.bader@canonical.com>

CVE-2017-5753
CVE-2017-5715
Signed-off-by: Marcelo Henrique Cerri <marcelo.cerri@canonical.com>
Acked-by: Stefan Bader <stefan.bader@canonical.com>
Acked-by: Khaled Elmously <khalid.elmously@canonical.com>
Signed-off-by: Stefan Bader <stefan.bader@canonical.com>

CVE-2017-5753
CVE-2017-5715
Signed-off-by: Marcelo Henrique Cerri <marcelo.cerri@canonical.com>
Acked-by: Stefan Bader <stefan.bader@canonical.com>
Acked-by: Khaled Elmously <khalid.elmously@canonical.com>
Signed-off-by: Stefan Bader <stefan.bader@canonical.com>

CVE-2017-5753
CVE-2017-5715
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
Signed-off-by: Marcelo Henrique Cerri <marcelo.cerri@canonical.com>
Acked-by: Stefan Bader <stefan.bader@canonical.com>
Acked-by: Khaled Elmously <khalid.elmously@canonical.com>
Signed-off-by: Stefan Bader <stefan.bader@canonical.com>

CVE-2017-5753
CVE-2017-5715

Initial change was missing code to correctly mask EDX bits of cpuid
level 7.0.

Fixes: 8339cae2 ("KVM: x86: Add speculative control CPUID support for guests")
Signed-off-by: Stefan Bader <stefan.bader@canonical.com>
Acked-by: Kleber Sacilotto de Souza <kleber.souza@canonical.com>
Acked-by: Khalid Elmously <khalid.elmously@canonical.com>
Signed-off-by: Kleber Sacilotto de Souza <kleber.souza@canonical.com>

CVE-2017-5715
CVE-2017-5753

Sparse populated CPUID leafs are collected in a software provided leaf to
avoid bloat of the x86_capability array, but there is no way to rebuild the
real leafs (e.g. for KVM CPUID enumeration) other than rereading the CPUID
leaf from the CPU. While this is possible it is problematic as it does not
take software disabled features into account. If a feature is disabled on
the host it should not be exposed to a guest either.

Add get_scattered_cpuid_leaf() which rebuilds the leaf from the scattered
cpuid table information and the active CPU features.

[ tglx: Rewrote changelog ]
Signed-off-by: He Chen <he.chen@linux.intel.com>
Reviewed-by: Borislav Petkov <bp@suse.de>
Cc: Luwei Kang <luwei.kang@intel.com>
Cc: kvm@vger.kernel.org
Cc: Radim Krčmář <rkrcmar@redhat.com>
Cc: Piotr Luc <Piotr.Luc@intel.com>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Paolo Bonzini <pbonzini@redhat.com>
Link: http://lkml.kernel.org/r/1478856336-9388-3-git-send-email-he.chen@linux.intel.comSigned-off-by: Thomas Gleixner <tglx@linutronix.de>
(backported from commit 47bdf337)
Signed-off-by: Stefan Bader <stefan.bader@canonical.com>
Acked-by: Kleber Sacilotto de Souza <kleber.souza@canonical.com>
Acked-by: Khalid Elmously <khalid.elmously@canonical.com>
Signed-off-by: Kleber Sacilotto de Souza <kleber.souza@canonical.com>

Ignore: yes
Signed-off-by: Kleber Sacilotto de Souza <kleber.souza@canonical.com>

Signed-off-by: Kleber Sacilotto de Souza <kleber.souza@canonical.com>

BugLink: http://bugs.launchpad.net/bugs/1743383Signed-off-by: Andy Whitcroft <apw@canonical.com>
Signed-off-by: Kleber Sacilotto de Souza <kleber.souza@canonical.com>

CVE-2017-5753
CVE-2017-5715

commit 0cb5b306 upstream.

Guest GPR values are live in the hardware GPRs at VM-exit.  Do not
leave any guest values in hardware GPRs after the guest GPR values are
saved to the vcpu_vmx structure.

This is a partial mitigation for CVE 2017-5715 and CVE 2017-5753.
Specifically, it defeats the Project Zero PoC for CVE 2017-5715.
Suggested-by: Eric Northup <digitaleric@google.com>
Signed-off-by: Jim Mattson <jmattson@google.com>
Reviewed-by: Eric Northup <digitaleric@google.com>
Reviewed-by: Benjamin Serebrin <serebrin@google.com>
Reviewed-by: Andrew Honig <ahonig@google.com>
[Paolo: Add AMD bits, Signed-off-by: Tom Lendacky <thomas.lendacky@amd.com>]
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Andy Whitcroft <apw@canonical.com>

CVE-2017-5753
CVE-2017-5715

This reverts commit a1c61c3a.
Signed-off-by: Andy Whitcroft <apw@canonical.com>

UBUNTU: SAUCE: x86/microcode: Extend post microcode reload to support IBPB feature -- repair missmerge

CVE-2017-5753
CVE-2017-5715

Fix missmerge leading to removal of late_initcall().
Signed-off-by: Andy Whitcroft <apw@canonical.com>

CVE-2017-5754

hwsync was added as a mnemonic for sync in binutils 2.25, prior
to that there is no support for hwsync. Replace uses of hwsync
with sync to maintain compatibility with older binutils.

Fixes: ee71154e ("UBUNTU: SAUCE: rfi-flush: Add barriers to the fallback L1D flushing")
Acked-by: Kamal Mostafa <kamal@canonical.com>
Signed-off-by: Seth Forshee <seth.forshee@canonical.com>

Ignore: yes
Signed-off-by: Kleber Sacilotto de Souza <kleber.souza@canonical.com>

Signed-off-by: Marcelo Henrique Cerri <marcelo.cerri@canonical.com>

CVE-2017-5753
CVE-2017-5715
Signed-off-by: Andy Whitcroft <apw@canonical.com>

CVE-2017-5753
CVE-2017-5715
Signed-off-by: Andy Whitcroft <apw@canonical.com>

CVE-2017-5754

BugLink: http://bugs.launchpad.net/bugs/1742772Signed-off-by: Marcelo Henrique Cerri <marcelo.cerri@canonical.com>

CVE-2017-5754

BugLink: http://bugs.launchpad.net/bugs/1742772

Spotted by Paul.
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Marcelo Henrique Cerri <marcelo.cerri@canonical.com>

CVE-2017-5754

BugLink: http://bugs.launchpad.net/bugs/1742772

Spotted by Paul.
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Marcelo Henrique Cerri <marcelo.cerri@canonical.com>

CVE-2017-5754

BugLink: http://bugs.launchpad.net/bugs/1742772

Add a data dependency on loads for the fallback flush. This
reduces or eliminates instances of incomplete flushing on P8 and
P9.
Signed-off-by: Marcelo Henrique Cerri <marcelo.cerri@canonical.com>

CVE-2017-5754

BugLink: http://bugs.launchpad.net/bugs/1742772Signed-off-by: Marcelo Henrique Cerri <marcelo.cerri@canonical.com>

CVE-2017-5754

BugLink: http://bugs.launchpad.net/bugs/1742772

We use the x86 'nopti' option because all the documenation on earth is
going to refer to that, and we can guess what users mean when they
specify that - they want to avoid any overhead due to Meltdown
mitigations.
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Marcelo Henrique Cerri <marcelo.cerri@canonical.com>

CVE-2017-5754

BugLink: http://bugs.launchpad.net/bugs/1742772

To avoid a bug like the previous commit ever happening again, put the
nops in a single place.
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Marcelo Henrique Cerri <marcelo.cerri@canonical.com>

CVE-2017-5754

BugLink: http://bugs.launchpad.net/bugs/1742772

We forgot to expand the number of nops in HRFI_TO_UNKNOWN when we
expanded the number of nops. The result is we actually overwrite the
rfid with a nop, which is not good. Luckily this is only used in
denorm_done, which is not hit often.

Spotted by Ram.
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Marcelo Henrique Cerri <marcelo.cerri@canonical.com>

CVE-2017-5754

BugLink: http://bugs.launchpad.net/bugs/1742772

Since we now have three nops, we need to branch further to get over
the nops to the branch to the fallback flush.

Instead of putting the branch in slot 1 and branching by 8, put it in
0 and branch all the way to keep it simple.
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Marcelo Henrique Cerri <marcelo.cerri@canonical.com>

CVE-2017-5754

BugLink: http://bugs.launchpad.net/bugs/1742772

Rather than assuming a successful return from the hcall will tell us a
valid flush type, if the hcall doesn't select one of the known flush
types use the fallback.
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Marcelo Henrique Cerri <marcelo.cerri@canonical.com>

CVE-2017-5754

BugLink: http://bugs.launchpad.net/bugs/1742772

Assume we need to do the fallback flush, unless firmware tells us
explicitly not to, by having the two needs-l1d-flush properties set to
disabled.

The previous logic assumed that the existence of a "fw-features"
node with no further properties was sufficient to indicate the flush
wasn't needed.

This should make no difference in practice with current firmwares,
because the "fw-features" node has only just been introduced, so there
are no machines in the wild which have an empty "fw-features" node.
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Marcelo Henrique Cerri <marcelo.cerri@canonical.com>

CVE-2017-5754

BugLink: http://bugs.launchpad.net/bugs/1742772

Add a hwsync after DCBT_STOP_ALL_STREAM_IDS to order loads/
stores prior to stopping prefetch with loads and stores
as a part of the flushing. A lwsync is needed to ensure
that after we don't mix the flushing of one congruence class
with another
Signed-off-by: Balbir Singh <bsingharora@gmail.com>
Signed-off-by: Marcelo Henrique Cerri <marcelo.cerri@canonical.com>

CVE-2017-5754

BugLink: http://bugs.launchpad.net/bugs/1742772Signed-off-by: Marcelo Henrique Cerri <marcelo.cerri@canonical.com>

UBUNTU: SAUCE: Remove setup.h include file otherwise compilation complains about missing header file.

CVE-2017-5754

BugLink: http://bugs.launchpad.net/bugs/1742772Signed-off-by: Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>
Signed-off-by: Marcelo Henrique Cerri <marcelo.cerri@canonical.com>

CVE-2017-5754

BugLink: http://bugs.launchpad.net/bugs/1742772

There's no reason to #error if we include ppc_asm.h in asm files, the
ifdef already prevents any problems.
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Marcelo Henrique Cerri <marcelo.cerri@canonical.com>

CVE-2017-5754

BugLink: http://bugs.launchpad.net/bugs/1742772

add an ori 31,31,0 speculation barrier ahead of the ori 30,30,0 flush
type, which was found necessary to completely flush out all lines.
Signed-off-by: Marcelo Henrique Cerri <marcelo.cerri@canonical.com>

CVE-2017-5754

BugLink: http://bugs.launchpad.net/bugs/1742772

To enable migration between machines with different flush types
enabled, allow the hypervisor to advertise more than one flush type,
and if we see that we patch both in. On any given machine only one
will be active (due to firmware configuration), but a kernel will be
able to migrate between machines with different flush instructions
enabled without modification.
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Marcelo Henrique Cerri <marcelo.cerri@canonical.com>

CVE-2017-5754

BugLink: http://bugs.launchpad.net/bugs/1742772Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Marcelo Henrique Cerri <marcelo.cerri@canonical.com>

CVE-2017-5754

BugLink: http://bugs.launchpad.net/bugs/1742772Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Marcelo Henrique Cerri <marcelo.cerri@canonical.com>

CVE-2017-5754

BugLink: http://bugs.launchpad.net/bugs/1742772Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Marcelo Henrique Cerri <marcelo.cerri@canonical.com>