lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Thu, 19 May 2022 08:53:04 +0200 From: Christophe Leroy <christophe.leroy@...roup.eu> To: Guenter Roeck <linux@...ck-us.net> Cc: "linuxppc-dev@...ts.ozlabs.org" <linuxppc-dev@...ts.ozlabs.org>, Paul Mackerras <paulus@...ba.org>, "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org> Subject: Re: [PATCH v1 3/4] powerpc/code-patching: Use jump_label for testing freed initmem Le 19/05/2022 à 08:27, Christophe Leroy a écrit : > > > Le 19/05/2022 à 04:17, Guenter Roeck a écrit : >> On Tue, Mar 22, 2022 at 04:40:20PM +0100, Christophe Leroy wrote: >>> Once init is done, initmem is freed forever so no need to >>> test system_state at every call to patch_instruction(). >>> >>> Use jump_label. >>> >>> This reduces by 2% the time needed to activate ftrace on an 8xx. >>> >> >> It also causes the qemu mpc8544ds emulation to crash. >> >> BUG: Unable to handle kernel data access on write at 0xc122eb34 >> Faulting instruction address: 0xc001b580 >> Oops: Kernel access of bad area, sig: 11 [#1] >> BE PAGE_SIZE=4K MPC8544 DS >> Modules linked in: >> CPU: 0 PID: 1 Comm: swapper Not tainted 5.18.0-rc7-next-20220518 #1 >> NIP: c001b580 LR: c001b560 CTR: 00000003 >> REGS: c5107dd0 TRAP: 0300 Not tainted (5.18.0-rc7-next-20220518) >> MSR: 00009000 <EE,ME> CR: 24000882 XER: 00000000 >> DEAR: c122eb34 ESR: 00800000 >> GPR00: c001b560 c5107ec0 c5120020 10000000 00000000 00000078 0c000000 cfffffff >> GPR08: c001e9ec 00000001 00000007 00000000 44000882 00000000 c0005178 00000000 >> GPR16: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 >> GPR24: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 c1230000 >> NIP [c001b580] free_initmem+0x48/0xa8 >> LR [c001b560] free_initmem+0x28/0xa8 >> Call Trace: >> [c5107ec0] [c001b560] free_initmem+0x28/0xa8 (unreliable) >> [c5107ee0] [c00051b0] kernel_init+0x38/0x150 >> [c5107f00] [c001626c] ret_from_kernel_thread+0x5c/0x64 >> Instruction dump: >> 3fe0c123 912a00dc 90010024 48000665 3d20c218 8929fa65 2c090000 41820058 >> 813feb34 2c090000 4082003c 39200001 <913feb34> 80010024 3cc0c114 83e1001c >> >> Reverting this patch fixes the problem. >> > > That's strange. > > I was able to reproduce the problem. > > Removing the __ro_after_init in front of > DEFINE_STATIC_KEY_FALSE(init_mem_is_free) fixes the problem. > > I can't understand why, mark_readonly() is called after free_initmem(). > Moving static_branch_enable(&init_mem_is_free) before mark_initmem_nx() also solves the problem. There must be something wrong with mark_initmem_nx(). Christophe
Powered by blists - more mailing lists