On Mon, 2018-10-08 at 15:28 +0200, gregkh@xxxxxxxxxxxxxxxxxxx wrote:
> The patch below does not apply to the 4.14-stable tree.
> If someone wants it applied there, or to any other stable or longterm
> tree, then please email the backport, including the original git commit
> id to <stable@xxxxxxxxxxxxxxx>.
Just repeating here what christophe said in the other thread....
---
Thanks,
Looks like 4.14 is missing commit 8cf4c05712f0
("powerpc/lib/code-patching: refactor patch_instruction()"), is that
acceptable for you to take that one too ?
[root@localhost linux-stable]# git checkout 4.14.y -b test
Switched to a new branch 'test'
[root@localhost linux-stable]# git cherry-pick
8cf4c05712f04a405f0dacebcca8f042b391694a
[test 7a0d0e13888a] powerpc/lib/code-patching: refactor patch_instruction()
Date: Fri Nov 24 08:31:07 2017 +0100
1 file changed, 15 insertions(+), 15 deletions(-)
[root@localhost linux-stable]# git cherry-pick
51c3c62b58b357e8d35e4cc32f7b4ec907426fe3
[test f08071c8ffde] powerpc: Avoid code patching freed init sections
Author: Michael Neuling <mikey@xxxxxxxxxxx>
Date: Fri Sep 14 11:14:11 2018 +1000
3 files changed, 9 insertions(+)
[root@localhost linux-stable]# git cherry-pick
b45ba4a51cde29b2939365ef0c07ad34c8321789
[test 2daecf52d401] powerpc/lib: fix book3s/32 boot failure due to code
patching
Date: Mon Oct 1 12:21:10 2018 +0000
1 file changed, 12 insertions(+), 8 deletions(-)
Christophe
>
> thanks,
>
> greg k-h
>
> ------------------ original commit in Linus's tree ------------------
>
> > From 51c3c62b58b357e8d35e4cc32f7b4ec907426fe3 Mon Sep 17 00:00:00 2001
>
> From: Michael Neuling <mikey@xxxxxxxxxxx>
> Date: Fri, 14 Sep 2018 11:14:11 +1000
> Subject: [PATCH] powerpc: Avoid code patching freed init sections
>
> This stops us from doing code patching in init sections after they've
> been freed.
>
> In this chain:
> kvm_guest_init() ->
> kvm_use_magic_page() ->
> fault_in_pages_readable() ->
> __get_user() ->
> __get_user_nocheck() ->
> barrier_nospec();
>
> We have a code patching location at barrier_nospec() and
> kvm_guest_init() is an init function. This whole chain gets inlined,
> so when we free the init section (hence kvm_guest_init()), this code
> goes away and hence should no longer be patched.
>
> We seen this as userspace memory corruption when using a memory
> checker while doing partition migration testing on powervm (this
> starts the code patching post migration via
> /sys/kernel/mobility/migration). In theory, it could also happen when
> using /sys/kernel/debug/powerpc/barrier_nospec.
>
> Cc: stable@xxxxxxxxxxxxxxx # 4.13+
> Signed-off-by: Michael Neuling <mikey@xxxxxxxxxxx>
> Reviewed-by: Nicholas Piggin <npiggin@xxxxxxxxx>
> Reviewed-by: Christophe Leroy <christophe.leroy@xxxxxx>
> Signed-off-by: Michael Ellerman <mpe@xxxxxxxxxxxxxx>
>
> diff --git a/arch/powerpc/include/asm/setup.h
> b/arch/powerpc/include/asm/setup.h
> index 1a951b00465d..1fffbba8d6a5 100644
> --- a/arch/powerpc/include/asm/setup.h
> +++ b/arch/powerpc/include/asm/setup.h
> @@ -9,6 +9,7 @@ extern void ppc_printk_progress(char *s, unsigned short hex);
>
> extern unsigned int rtas_data;
> extern unsigned long long memory_limit;
> +extern bool init_mem_is_free;
> extern unsigned long klimit;
> extern void *zalloc_maybe_bootmem(size_t size, gfp_t mask);
>
> diff --git a/arch/powerpc/lib/code-patching.c b/arch/powerpc/lib/code-
> patching.c
> index 850f3b8f4da5..6ae2777c220d 100644
> --- a/arch/powerpc/lib/code-patching.c
> +++ b/arch/powerpc/lib/code-patching.c
> @@ -28,6 +28,12 @@ static int __patch_instruction(unsigned int *exec_addr,
> unsigned int instr,
> {
> int err;
>
> + /* Make sure we aren't patching a freed init section */
> + if (init_mem_is_free && init_section_contains(exec_addr, 4)) {
> + pr_debug("Skipping init section patching addr: 0x%px\n",
> exec_addr);
> + return 0;
> + }
> +
> __put_user_size(instr, patch_addr, 4, err);
> if (err)
> return err;
> diff --git a/arch/powerpc/mm/mem.c b/arch/powerpc/mm/mem.c
> index 5c8530d0c611..04ccb274a620 100644
> --- a/arch/powerpc/mm/mem.c
> +++ b/arch/powerpc/mm/mem.c
> @@ -63,6 +63,7 @@
> #endif
>
> unsigned long long memory_limit;
> +bool init_mem_is_free;
>
> #ifdef CONFIG_HIGHMEM
> pte_t *kmap_pte;
> @@ -396,6 +397,7 @@ void free_initmem(void)
> {
> ppc_md.progress = ppc_printk_progress;
> mark_initmem_nx();
> + init_mem_is_free = true;
> free_initmem_default(POISON_FREE_INITMEM);
> }
>
>
