From: Greg Kroah-Hartman Date: Mon, 16 Oct 2023 07:51:31 +0000 (+0200) Subject: 5.15-stable patches X-Git-Tag: v5.15.136~19 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=e5ececddc091a80431ec2c7c118163bed8e838bb;p=thirdparty%2Fkernel%2Fstable-queue.git 5.15-stable patches added patches: x86-alternatives-disable-kasan-in-apply_alternatives.patch --- diff --git a/queue-5.15/series b/queue-5.15/series index 4a9000066c7..5a1a78f82a1 100644 --- a/queue-5.15/series +++ b/queue-5.15/series @@ -77,6 +77,7 @@ counter-microchip-tcb-capture-fix-the-use-of-internal-gclk-logic.patch usb-gadget-udc-xilinx-replace-memcpy-with-memcpy_toio.patch usb-gadget-ncm-handle-decoding-of-multiple-ntb-s-in-unwrap-call.patch usb-cdnsp-fixes-issue-with-dequeuing-not-queued-requests.patch +x86-alternatives-disable-kasan-in-apply_alternatives.patch dmaengine-idxd-use-spin_lock_irqsave-before-wait_eve.patch dmaengine-mediatek-fix-deadlock-caused-by-synchroniz.patch powerpc-8xx-fix-pte_access_permitted-for-page_none.patch diff --git a/queue-5.15/x86-alternatives-disable-kasan-in-apply_alternatives.patch b/queue-5.15/x86-alternatives-disable-kasan-in-apply_alternatives.patch new file mode 100644 index 00000000000..271edd5f54f --- /dev/null +++ b/queue-5.15/x86-alternatives-disable-kasan-in-apply_alternatives.patch @@ -0,0 +1,77 @@ +From d35652a5fc9944784f6f50a5c979518ff8dacf61 Mon Sep 17 00:00:00 2001 +From: "Kirill A. Shutemov" +Date: Thu, 12 Oct 2023 13:04:24 +0300 +Subject: x86/alternatives: Disable KASAN in apply_alternatives() + +From: Kirill A. Shutemov + +commit d35652a5fc9944784f6f50a5c979518ff8dacf61 upstream. + +Fei has reported that KASAN triggers during apply_alternatives() on +a 5-level paging machine: + + BUG: KASAN: out-of-bounds in rcu_is_watching() + Read of size 4 at addr ff110003ee6419a0 by task swapper/0/0 + ... + __asan_load4() + rcu_is_watching() + trace_hardirqs_on() + text_poke_early() + apply_alternatives() + ... + +On machines with 5-level paging, cpu_feature_enabled(X86_FEATURE_LA57) +gets patched. It includes KASAN code, where KASAN_SHADOW_START depends on +__VIRTUAL_MASK_SHIFT, which is defined with cpu_feature_enabled(). + +KASAN gets confused when apply_alternatives() patches the +KASAN_SHADOW_START users. A test patch that makes KASAN_SHADOW_START +static, by replacing __VIRTUAL_MASK_SHIFT with 56, works around the issue. + +Fix it for real by disabling KASAN while the kernel is patching alternatives. + +[ mingo: updated the changelog ] + +Fixes: 6657fca06e3f ("x86/mm: Allow to boot without LA57 if CONFIG_X86_5LEVEL=y") +Reported-by: Fei Yang +Signed-off-by: Kirill A. Shutemov +Signed-off-by: Ingo Molnar +Acked-by: Peter Zijlstra (Intel) +Cc: Linus Torvalds +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/20231012100424.1456-1-kirill.shutemov@linux.intel.com +Signed-off-by: Kirill A. Shutemov +Signed-off-by: Greg Kroah-Hartman +--- + arch/x86/kernel/alternative.c | 13 +++++++++++++ + 1 file changed, 13 insertions(+) + +--- a/arch/x86/kernel/alternative.c ++++ b/arch/x86/kernel/alternative.c +@@ -269,6 +269,17 @@ void __init_or_module noinline apply_alt + u8 insn_buff[MAX_PATCH_LEN]; + + DPRINTK("alt table %px, -> %px", start, end); ++ ++ /* ++ * In the case CONFIG_X86_5LEVEL=y, KASAN_SHADOW_START is defined using ++ * cpu_feature_enabled(X86_FEATURE_LA57) and is therefore patched here. ++ * During the process, KASAN becomes confused seeing partial LA57 ++ * conversion and triggers a false-positive out-of-bound report. ++ * ++ * Disable KASAN until the patching is complete. ++ */ ++ kasan_disable_current(); ++ + /* + * The scan order should be from start to end. A later scanned + * alternative code can overwrite previously scanned alternative code. +@@ -336,6 +347,8 @@ void __init_or_module noinline apply_alt + next: + optimize_nops(instr, a->instrlen); + } ++ ++ kasan_enable_current(); + } + + #if defined(CONFIG_RETPOLINE) && defined(CONFIG_STACK_VALIDATION)