]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
powerpc: Avoid code patching freed init sections
authorMichael Neuling <mikey@neuling.org>
Thu, 11 Apr 2019 11:45:59 +0000 (21:45 +1000)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Wed, 17 Apr 2019 06:36:40 +0000 (08:36 +0200)
commit1c38a84d45862be06ac418618981631eddbda741
treed07a9e4e77e97eb6f3870f53e24dfe774a4009db
parentf3286f1a71e3ccb80c53add0e6b322fc73544b77
powerpc: Avoid code patching freed init sections

commit 51c3c62b58b357e8d35e4cc32f7b4ec907426fe3 upstream.

This stops us from doing code patching in init sections after they've
been freed.

In this chain:
  kvm_guest_init() ->
    kvm_use_magic_page() ->
      fault_in_pages_readable() ->
 __get_user() ->
   __get_user_nocheck() ->
     barrier_nospec();

We have a code patching location at barrier_nospec() and
kvm_guest_init() is an init function. This whole chain gets inlined,
so when we free the init section (hence kvm_guest_init()), this code
goes away and hence should no longer be patched.

We seen this as userspace memory corruption when using a memory
checker while doing partition migration testing on powervm (this
starts the code patching post migration via
/sys/kernel/mobility/migration). In theory, it could also happen when
using /sys/kernel/debug/powerpc/barrier_nospec.

Cc: stable@vger.kernel.org # 4.13+
Signed-off-by: Michael Neuling <mikey@neuling.org>
Reviewed-by: Nicholas Piggin <npiggin@gmail.com>
Reviewed-by: Christophe Leroy <christophe.leroy@c-s.fr>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
arch/powerpc/include/asm/setup.h
arch/powerpc/lib/code-patching.c
arch/powerpc/mm/mem.c