From cfc49ff1224a8db755a588aa42837a64d88428c2 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Mon, 22 Jan 2024 15:26:54 -0800 Subject: [PATCH] 6.1-stable patches added patches: riscv-fix-wrong-usage-of-lm_alias-when-splitting-a-huge-linear-mapping.patch --- ...when-splitting-a-huge-linear-mapping.patch | 43 +++++++++++++++++++ queue-6.1/series | 1 + 2 files changed, 44 insertions(+) create mode 100644 queue-6.1/riscv-fix-wrong-usage-of-lm_alias-when-splitting-a-huge-linear-mapping.patch diff --git a/queue-6.1/riscv-fix-wrong-usage-of-lm_alias-when-splitting-a-huge-linear-mapping.patch b/queue-6.1/riscv-fix-wrong-usage-of-lm_alias-when-splitting-a-huge-linear-mapping.patch new file mode 100644 index 00000000000..bf057f37c0d --- /dev/null +++ b/queue-6.1/riscv-fix-wrong-usage-of-lm_alias-when-splitting-a-huge-linear-mapping.patch @@ -0,0 +1,43 @@ +From c29fc621e1a49949a14c7fa031dd4760087bfb29 Mon Sep 17 00:00:00 2001 +From: Alexandre Ghiti +Date: Tue, 12 Dec 2023 20:54:00 +0100 +Subject: riscv: Fix wrong usage of lm_alias() when splitting a huge linear mapping + +From: Alexandre Ghiti + +commit c29fc621e1a49949a14c7fa031dd4760087bfb29 upstream. + +lm_alias() can only be used on kernel mappings since it explicitly uses +__pa_symbol(), so simply fix this by checking where the address belongs +to before. + +Fixes: 311cd2f6e253 ("riscv: Fix set_memory_XX() and set_direct_map_XX() by splitting huge linear mappings") +Reported-by: syzbot+afb726d49f84c8d95ee1@syzkaller.appspotmail.com +Closes: https://lore.kernel.org/linux-riscv/000000000000620dd0060c02c5e1@google.com/ +Signed-off-by: Alexandre Ghiti +Reviewed-by: Charlie Jenkins +Link: https://lore.kernel.org/r/20231212195400.128457-1-alexghiti@rivosinc.com +Signed-off-by: Palmer Dabbelt +Signed-off-by: Greg Kroah-Hartman +--- + arch/riscv/mm/pageattr.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +--- a/arch/riscv/mm/pageattr.c ++++ b/arch/riscv/mm/pageattr.c +@@ -304,8 +304,13 @@ static int __set_memory(unsigned long ad + goto unlock; + } + } else if (is_kernel_mapping(start) || is_linear_mapping(start)) { +- lm_start = (unsigned long)lm_alias(start); +- lm_end = (unsigned long)lm_alias(end); ++ if (is_kernel_mapping(start)) { ++ lm_start = (unsigned long)lm_alias(start); ++ lm_end = (unsigned long)lm_alias(end); ++ } else { ++ lm_start = start; ++ lm_end = end; ++ } + + ret = split_linear_mapping(lm_start, lm_end); + if (ret) diff --git a/queue-6.1/series b/queue-6.1/series index b24c9011d37..a0e6d40c48a 100644 --- a/queue-6.1/series +++ b/queue-6.1/series @@ -414,3 +414,4 @@ ipv6-mcast-fix-data-race-in-ipv6_mc_down-mld_ifc_wor.patch i2c-s3c24xx-fix-read-transfers-in-polling-mode.patch i2c-s3c24xx-fix-transferring-more-than-one-message-i.patch block-remove-special-casing-of-compound-pages.patch +riscv-fix-wrong-usage-of-lm_alias-when-splitting-a-huge-linear-mapping.patch -- 2.47.3