[ciqlts9_6] x86/bugs: Make Safe-RET robust against interrupt injection by ciq-kernel-automation[bot] · Pull Request #1726 · ctrliq/kernel-src-tree

ciq-kernel-automation · 2026-10-21T23:42:34Z

Summary

This PR has been automatically created after successful completion of all CI stages.

Commit Message(s)

x86/bugs: Make Safe-RET robust against interrupt injection

jira VULN-196245
cve CVE-2026-68480
commit-author Borislav Petkov (AMD) <bp@alien8.de>
commit 7e7f81cf6f5ca3311e526308f55d7c54d3ba71f9
upstream-diff This tree predates the v6.11 alternative-macro rework,
              so its assembler ALTERNATIVE_2 cannot expand a
              multi-instruction macro like upstream's
              __HANDLE_INTR_SAFERET() into an alternative replacement.
              Instead, HANDLE_INTR_SAFERET() calls out-of-line helpers
              __handle_intr_saferet() / __handle_intr_saferet_alias()
              added to retpoline.S through a 5-byte CALL alternative
              per SRSO variant, matching the official 5.15.y
              (52db77a13be2) and 5.10.y (dfefa3c51370) backports of
              this fix; <asm/ptrace-abi.h> is included by retpoline.S
              accordingly.  Everything else - the paranoid_entry /
              error_entry call sites, the VALIDATE_UNRET_END relocation
              in error_entry, the Safe-RET ANNOTATE_NOENDBR annotations
              and handle_interrupted_saferet() in bugs.c - is identical
              to upstream (minor comment wording and indentation tweaks
              follow the stable backports).

Test Results

✅ Build Stage

Architecture	Build Time	Total Time
x86_64	24m 0s	25m 10s
aarch64	19m 50s	20m 36s

View build logs

✅ Boot Verification

Status: Passed (all architectures)
View boot logs

✅ Kernel Selftests

Architecture	Passed	Failed	Compared Against	Status
x86_64	206	43	ciqlts9_6	✅ No regressions
aarch64	155	44	ciqlts9_6	✅ No regressions

View kselftest logs

✅ LTP Results

Architecture	Passed	Failed	Compared Against	Status
x86_64	1453	82	ciqlts9_6	✅ No regressions
aarch64	1426	83	ciqlts9_6	✅ No regressions

View LTP logs

🤖 This PR was automatically generated by GitHub Actions
Run ID: 39664748730

github-actions · 2026-10-21T23:49:28Z

🤖 Validation Checks In Progress Workflow run: https://github.com/ctrliq/kernel-src-tree/actions/runs/39695862842

github-actions · 2026-10-21T23:49:30Z

🔍 Diffofdiffs: 1 backport differs from upstream

View the diffofdiffs report.

Open to anyone signed in to GitHub. Report expires 2027-01-19 23:42 UTC.

#	Subject	Backport	Upstream
1	`x86/bugs: Make Safe-RET robust against interrupt injection`	`b896930d0352`	`7e7f81cf6f5c`

Checked PR revision b896930d0352 against base 1db6d00b0eae.

github-actions · 2026-10-21T23:51:04Z

JIRA PR Check Results

1 commit(s) with issues found:

Commit `b896930d0352`

Summary: x86/bugs: Make Safe-RET robust against interrupt injection

⚠️ Warnings:

VULN-196245: No time logged - please log time manually

Summary: Checked 1 commit(s) total.

github-actions · 2026-10-21T23:51:05Z

✅ Validation checks completed successfully View full results: https://github.com/ctrliq/kernel-src-tree/actions/runs/39695862842

bmastbergen · 2026-10-22T13:57:54Z

JIRA PR Check Results

1 commit(s) with issues found:

Commit b896930d0352

Summary: x86/bugs: Make Safe-RET robust against interrupt injection

⚠️ Warnings:

VULN-196245: No time logged - please log time manually

Summary: Checked 1 commit(s) total.

Time logged.

PlaidCat · 2026-10-22T14:31:06Z

 SYM_CODE_END(srso_alias_return_thunk)
 	.popsection

+	.pushsection .noinstr.text, "ax"


In upstream and linux-5.15.y this is wrapped in

#ifdef CONFIG_CPU_SRSO <code> #endif /* CONFIG_CPU_SRSO */

There are other sections of this commit wrapped in this ... was there a specific reason the ifdef was dropped here?

This block sits inside the pre-existing #ifdef CONFIG_MITIGATION_SRSO region that wraps the whole SRSO section (that is this trees equivalent to CONFIG_CPU_SRSO). in 5.15.y and 5.10.y that wasn't the case which is why it needed to be independently #ifdef'd.

I didn't unroll enough to see that it was WAY up there

PlaidCat

PlaidCat · 2026-10-22T15:21:40Z

 SYM_CODE_END(srso_alias_return_thunk)
 	.popsection

+	.pushsection .noinstr.text, "ax"


I didn't unroll enough to see that it was WAY up there

shreeya-patel98

I think the upstream commit can be cherry-picked as is on 9.6. ciqlts9_6 has apply_relocation(), so the old ALTERNATIVE_2 can carry the inline __HANDLE_INTR_SAFERET() sequence.

The only thing that breaks is the build: upstream's new #include <asm/ptrace-abi.h> in nospec-branch.h makes RIP expand to 128 in .S files, and aesni-intel_asm.S still uses ONE(%RIP). Lowercasing those two operands fixes it:

--- a/arch/x86/crypto/aesni-intel_asm.S
+++ b/arch/x86/crypto/aesni-intel_asm.S
@@ -799 +799 @@
-       MOVADQ          ONE(%RIP),\TMP1
+       MOVADQ          ONE(%rip),\TMP1
@@ -871 +871 @@         
-       MOVADQ     ONE(%RIP),\TMP1
+       MOVADQ     ONE(%rip),\TMP1

Beyond that, only minor context conflicts in nospec-branch.h needed resolving. With these changes, vmlinux builds cleanly with objtool. Also register names are case-insensitive in gas, so this doesn't change the generated code.

github-actions · 2026-10-23T14:18:39Z

🤖 Validation Checks In Progress Workflow run: https://github.com/ctrliq/kernel-src-tree/actions/runs/39968508220

github-actions · 2026-10-23T14:18:40Z

🔍 Diffofdiffs: 1 backport differs from upstream

View the diffofdiffs report.

Open to anyone signed in to GitHub. Report expires 2027-01-21 14:09 UTC.

#	Subject	Backport	Upstream
1	`x86/bugs: Make Safe-RET robust against interrupt injection`	`c9b17d7ba743`	`7e7f81cf6f5c`

Checked PR revision c9b17d7ba743 against base 1db6d00b0eae.

github-actions · 2026-10-23T14:20:27Z

✅ Validation checks completed successfully View full results: https://github.com/ctrliq/kernel-src-tree/actions/runs/39968508220

jira VULN-196245 cve CVE-2026-68480 commit-author Borislav Petkov (AMD) <bp@alien8.de> commit 7e7f81c upstream-diff Two adjustments: (1) __HANDLE_INTR_SAFERET() is inserted before this tree's #ifdef __ASSEMBLY__ boundary where upstream adds it before its #ifdef __ASSEMBLER__ boundary - the same shared macro zone, so only the surrounding context differs; (2) upstream's new <asm/ptrace-abi.h> include in nospec-branch.h defines RIP as 128, which the preprocessor substitutes into the two uppercase ONE(%RIP) operands in arch/x86/crypto/aesni-intel_asm.S (lines 799 and 871, the only uppercase register-name operands in any .S file), so those are lowercased to ONE(%rip); register names are case-insensitive in gas and the assembled objects are byte-identical. An attacker injecting interrupts while the Safe-RET mitigation executes on machines affected by SRSO can neutralize the safe return sequence, potentially leading to data leakage through speculative execution. Fixup register state as if the Safe-RET sequence executed successfully by "emulating" it, in a manner of speaking, and avoid executing a RET instruction after returning from the interrupt. Co-developed-by: David Kaplan <David.Kaplan@amd.com> Signed-off-by: David Kaplan <David.Kaplan@amd.com> Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de> (cherry picked from commit 7e7f81c) Signed-off-by: Brett Mastbergen <bmastbergen@ciq.com>

bmastbergen · 2026-10-23T14:32:14Z

I think the upstream commit can be cherry-picked as is on 9.6. ciqlts9_6 has apply_relocation(), so the old ALTERNATIVE_2 can carry the inline __HANDLE_INTR_SAFERET() sequence.

The only thing that breaks is the build: upstream's new #include <asm/ptrace-abi.h> in nospec-branch.h makes RIP expand to 128 in .S files, and aesni-intel_asm.S still uses ONE(%RIP). Lowercasing those two operands fixes it:
--- a/arch/x86/crypto/aesni-intel_asm.S
+++ b/arch/x86/crypto/aesni-intel_asm.S
@@ -799 +799 @@
-       MOVADQ          ONE(%RIP),\TMP1
+       MOVADQ          ONE(%rip),\TMP1
@@ -871 +871 @@         
-       MOVADQ     ONE(%RIP),\TMP1
+       MOVADQ     ONE(%rip),\TMP1
Beyond that, only minor context conflicts in nospec-branch.h needed resolving. With these changes, vmlinux builds cleanly with objtool. Also register names are case-insensitive in gas, so this doesn't change the generated code.

You are right. I think when it didn't apply I instantly went down the 5.15/5.10 route which kinda led me down this hybrid path. I've pushed something closer to upstream. See what you think.

github-actions · 2026-10-23T14:34:18Z

🤖 Validation Checks In Progress Workflow run: https://github.com/ctrliq/kernel-src-tree/actions/runs/39970743678

github-actions · 2026-10-23T14:34:21Z

🔍 Diffofdiffs: 1 backport differs from upstream

View the diffofdiffs report.

Open to anyone signed in to GitHub. Report expires 2027-01-21 14:26 UTC.

#	Subject	Backport	Upstream
1	`x86/bugs: Make Safe-RET robust against interrupt injection`	`b97b40ebe1fd`	`7e7f81cf6f5c`

Checked PR revision b97b40ebe1fd against base 1db6d00b0eae.

github-actions · 2026-10-23T14:36:05Z

✅ Validation checks completed successfully View full results: https://github.com/ctrliq/kernel-src-tree/actions/runs/39970743678

ciq-kernel-automation Bot added the created-by-kernelci Tag PRs that were automatically created when a user branch was pushed to the repo (kernelCI) label Oct 21, 2026

PlaidCat assigned bmastbergen Oct 22, 2026

PlaidCat requested a review from a team October 22, 2026 13:44

PlaidCat reviewed Oct 22, 2026

View reviewed changes

PlaidCat previously approved these changes Oct 22, 2026

View reviewed changes

PlaidCat requested a review from a team October 22, 2026 15:22

shreeya-patel98 previously approved these changes Oct 23, 2026

View reviewed changes

shreeya-patel98 self-requested a review October 23, 2026 11:03

shreeya-patel98 reviewed Oct 23, 2026

View reviewed changes

shreeya-patel98 self-requested a review October 23, 2026 11:30

bmastbergen dismissed stale reviews from shreeya-patel98 and PlaidCat via c9b17d7 October 23, 2026 14:09

bmastbergen force-pushed the {bmastbergen_cves}_ciqlts9_6 branch from b896930 to c9b17d7 Compare October 23, 2026 14:09

bmastbergen force-pushed the {bmastbergen_cves}_ciqlts9_6 branch from c9b17d7 to b97b40e Compare October 23, 2026 14:26

bmastbergen requested a review from PlaidCat October 23, 2026 14:42

Conversation

ciq-kernel-automation Bot commented Oct 21, 2026

Summary

Commit Message(s)

Test Results

✅ Build Stage

✅ Boot Verification

✅ Kernel Selftests

✅ LTP Results

Uh oh!

github-actions Bot commented Oct 21, 2026

Uh oh!

github-actions Bot commented Oct 21, 2026

🔍 Diffofdiffs: 1 backport differs from upstream

Uh oh!

github-actions Bot commented Oct 21, 2026

JIRA PR Check Results

Commit b896930d0352

Uh oh!

github-actions Bot commented Oct 21, 2026

Uh oh!

bmastbergen commented Oct 22, 2026

JIRA PR Check Results

Commit b896930d0352

Uh oh!

PlaidCat Oct 22, 2026

Choose a reason for hiding this comment

Uh oh!

bmastbergen Oct 22, 2026

Choose a reason for hiding this comment

Uh oh!

PlaidCat Oct 22, 2026

Choose a reason for hiding this comment

Uh oh!

PlaidCat left a comment

Choose a reason for hiding this comment

Uh oh!

PlaidCat Oct 22, 2026

Choose a reason for hiding this comment

Uh oh!

shreeya-patel98 left a comment

Choose a reason for hiding this comment

Uh oh!

github-actions Bot commented Oct 23, 2026

Uh oh!

github-actions Bot commented Oct 23, 2026

🔍 Diffofdiffs: 1 backport differs from upstream

Uh oh!

github-actions Bot commented Oct 23, 2026

Uh oh!

bmastbergen commented Oct 23, 2026

Uh oh!

github-actions Bot commented Oct 23, 2026

Uh oh!

github-actions Bot commented Oct 23, 2026

🔍 Diffofdiffs: 1 backport differs from upstream

Uh oh!

github-actions Bot commented Oct 23, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Milestone

Development

Uh oh!

3 participants

Commit `b896930d0352`

Commit `b896930d0352`