tree 0abadfec0aa4b97938751ef6b72641746a4c0270
parent 6b47a8256a56c261ab008863a548f245fdcc8b11
author Will Deacon <will.deacon@arm.com> 1517592700 +0000
committer Greg Kroah-Hartman <gregkh@linuxfoundation.org> 1518808973 +0100

arm64: entry: Apply BP hardening for suspicious interrupts from EL0


Commit 30d88c0e3ace upstream.

It is possible to take an IRQ from EL0 following a branch to a kernel
address in such a way that the IRQ is prioritised over the instruction
abort. Whilst an attacker would need to get the stars to align here,
it might be sufficient with enough calibration so perform BP hardening
in the rare case that we see a kernel address in the ELR when handling
an IRQ from EL0.

Reported-by: Dan Hettena <dhettena@nvidia.com>
Reviewed-by: Marc Zyngier <marc.zyngier@arm.com>
Signed-off-by: Will Deacon <will.deacon@arm.com>
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>