Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 51c3c62b authored by Michael Neuling's avatar Michael Neuling Committed by Michael Ellerman
Browse files

powerpc: Avoid code patching freed init sections 



This stops us from doing code patching in init sections after they've
been freed.

In this chain:
  kvm_guest_init() ->
    kvm_use_magic_page() ->
      fault_in_pages_readable() ->
	 __get_user() ->
	   __get_user_nocheck() ->
	     barrier_nospec();

We have a code patching location at barrier_nospec() and
kvm_guest_init() is an init function. This whole chain gets inlined,
so when we free the init section (hence kvm_guest_init()), this code
goes away and hence should no longer be patched.

We seen this as userspace memory corruption when using a memory
checker while doing partition migration testing on powervm (this
starts the code patching post migration via
/sys/kernel/mobility/migration). In theory, it could also happen when
using /sys/kernel/debug/powerpc/barrier_nospec.

Cc: stable@vger.kernel.org # 4.13+
Signed-off-by: default avatarMichael Neuling <mikey@neuling.org>
Reviewed-by: default avatarNicholas Piggin <npiggin@gmail.com>
Reviewed-by: default avatarChristophe Leroy <christophe.leroy@c-s.fr>
Signed-off-by: default avatarMichael Ellerman <mpe@ellerman.id.au>
parent f14040bc

arch/powerpc/include/asm/setup.h

+1 −0
Original line number Diff line number Diff line
@@ -9,6 +9,7 @@ extern void ppc_printk_progress(char *s, unsigned short hex); 


extern unsigned int rtas_data;

extern unsigned long long memory_limit;

extern bool init_mem_is_free;

extern unsigned long klimit;

extern void *zalloc_maybe_bootmem(size_t size, gfp_t mask);

arch/powerpc/lib/code-patching.c

+6 −0
Original line number Diff line number Diff line
@@ -28,6 +28,12 @@ static int __patch_instruction(unsigned int *exec_addr, unsigned int instr, 
{

	int err;



	/* Make sure we aren't patching a freed init section */

	if (init_mem_is_free && init_section_contains(exec_addr, 4)) {

		pr_debug("Skipping init section patching addr: 0x%px\n", exec_addr);

		return 0;

	}



	__put_user_size(instr, patch_addr, 4, err);

	if (err)

		return err;

arch/powerpc/mm/mem.c

+2 −0
Original line number Diff line number Diff line
@@ -63,6 +63,7 @@ 
#endif



unsigned long long memory_limit;

bool init_mem_is_free;



#ifdef CONFIG_HIGHMEM

pte_t *kmap_pte;
@@ -396,6 +397,7 @@ void free_initmem(void) 
{

	ppc_md.progress = ppc_printk_progress;

	mark_initmem_nx();

	init_mem_is_free = true;

	free_initmem_default(POISON_FREE_INITMEM);

}