6.1-stable patches

added patches:
	x86-alternatives-disable-kasan-in-apply_alternatives.patch

diff --git a/queue-6.1/series b/queue-6.1/series
index 565a5b79fb5c75b78edeb5917ea4ef32bae57d54..4b093984e0041973d4114998aacf44c563d0a907 100644 (file)
--- a/queue-6.1/series
+++ b/queue-6.1/series
@@ -123,6 +123,7 @@ usb-typec-ucsi-clear-event_pending-bit-if-ucsi_send_command-fails.patch
 usb-gadget-udc-xilinx-replace-memcpy-with-memcpy_toio.patch
 usb-gadget-ncm-handle-decoding-of-multiple-ntb-s-in-unwrap-call.patch
 usb-cdnsp-fixes-issue-with-dequeuing-not-queued-requests.patch
+x86-alternatives-disable-kasan-in-apply_alternatives.patch
 dmaengine-idxd-use-spin_lock_irqsave-before-wait_eve.patch
 dmaengine-mediatek-fix-deadlock-caused-by-synchroniz.patch
 powerpc-8xx-fix-pte_access_permitted-for-page_none.patch

diff --git a/queue-6.1/x86-alternatives-disable-kasan-in-apply_alternatives.patch b/queue-6.1/x86-alternatives-disable-kasan-in-apply_alternatives.patch
new file mode 100644 (file)
index 0000000..d896541
--- /dev/null
+++ b/queue-6.1/x86-alternatives-disable-kasan-in-apply_alternatives.patch
@@ -0,0 +1,77 @@
+From d35652a5fc9944784f6f50a5c979518ff8dacf61 Mon Sep 17 00:00:00 2001
+From: "Kirill A. Shutemov" <kirill.shutemov@linux.intel.com>
+Date: Thu, 12 Oct 2023 13:04:24 +0300
+Subject: x86/alternatives: Disable KASAN in apply_alternatives()
+
+From: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
+
+commit d35652a5fc9944784f6f50a5c979518ff8dacf61 upstream.
+
+Fei has reported that KASAN triggers during apply_alternatives() on
+a 5-level paging machine:
+
+       BUG: KASAN: out-of-bounds in rcu_is_watching()
+       Read of size 4 at addr ff110003ee6419a0 by task swapper/0/0
+       ...
+       __asan_load4()
+       rcu_is_watching()
+       trace_hardirqs_on()
+       text_poke_early()
+       apply_alternatives()
+       ...
+
+On machines with 5-level paging, cpu_feature_enabled(X86_FEATURE_LA57)
+gets patched. It includes KASAN code, where KASAN_SHADOW_START depends on
+__VIRTUAL_MASK_SHIFT, which is defined with cpu_feature_enabled().
+
+KASAN gets confused when apply_alternatives() patches the
+KASAN_SHADOW_START users. A test patch that makes KASAN_SHADOW_START
+static, by replacing __VIRTUAL_MASK_SHIFT with 56, works around the issue.
+
+Fix it for real by disabling KASAN while the kernel is patching alternatives.
+
+[ mingo: updated the changelog ]
+
+Fixes: 6657fca06e3f ("x86/mm: Allow to boot without LA57 if CONFIG_X86_5LEVEL=y")
+Reported-by: Fei Yang <fei.yang@intel.com>
+Signed-off-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: stable@vger.kernel.org
+Link: https://lore.kernel.org/r/20231012100424.1456-1-kirill.shutemov@linux.intel.com
+Signed-off-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/x86/kernel/alternative.c |   13 +++++++++++++
+ 1 file changed, 13 insertions(+)
+
+--- a/arch/x86/kernel/alternative.c
++++ b/arch/x86/kernel/alternative.c
+@@ -270,6 +270,17 @@ void __init_or_module noinline apply_alt
+       u8 insn_buff[MAX_PATCH_LEN];
+ 
+       DPRINTK("alt table %px, -> %px", start, end);
++
++      /*
++       * In the case CONFIG_X86_5LEVEL=y, KASAN_SHADOW_START is defined using
++       * cpu_feature_enabled(X86_FEATURE_LA57) and is therefore patched here.
++       * During the process, KASAN becomes confused seeing partial LA57
++       * conversion and triggers a false-positive out-of-bound report.
++       *
++       * Disable KASAN until the patching is complete.
++       */
++      kasan_disable_current();
++
+       /*
+        * The scan order should be from start to end. A later scanned
+        * alternative code can overwrite previously scanned alternative code.
+@@ -337,6 +348,8 @@ void __init_or_module noinline apply_alt
+ next:
+               optimize_nops(instr, a->instrlen);
+       }
++
++      kasan_enable_current();
+ }
+ 
+ static inline bool is_jcc32(struct insn *insn)