linux-kernel - [PATCH v2 1/2] riscv: Fix crash during early errata patching

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Sat, 26 Nov 2022 00:09:19 -0600
From:   Samuel Holland <samuel@...lland.org>
To:     Palmer Dabbelt <palmer@...belt.com>,
        linux-riscv@...ts.infradead.org
Cc:     Samuel Holland <samuel@...lland.org>,
        Heiko Stuebner <heiko@...ech.de>,
        Albert Ou <aou@...s.berkeley.edu>,
        Alexandre Ghiti <alexandre.ghiti@...onical.com>,
        Paul Walmsley <paul.walmsley@...ive.com>,
        linux-kernel@...r.kernel.org
Subject: [PATCH v2 1/2] riscv: Fix crash during early errata patching

The patch function for the T-Head PBMT errata calls __pa_symbol() before
relocation. This crashes when CONFIG_DEBUG_VIRTUAL is enabled, because
__pa_symbol() forwards to __phys_addr_symbol(), and __phys_addr_symbol()
checks against the absolute kernel start/end address.

Fix this by checking against the kernel map instead of a symbol address.

Fixes: a35707c3d850 ("riscv: add memory-type errata for T-Head")
Reviewed-by: Heiko Stuebner <heiko@...ech.de>
Tested-by: Heiko Stuebner <heiko@...ech.de>
Signed-off-by: Samuel Holland <samuel@...lland.org>
---

Changes in v2:
 - Fix __phys_addr_symbol instead of avoiding it in the errata code

 arch/riscv/mm/physaddr.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/riscv/mm/physaddr.c b/arch/riscv/mm/physaddr.c
index 19cf25a74ee2..9b18bda74154 100644
--- a/arch/riscv/mm/physaddr.c
+++ b/arch/riscv/mm/physaddr.c
@@ -22,7 +22,7 @@ EXPORT_SYMBOL(__virt_to_phys);
 phys_addr_t __phys_addr_symbol(unsigned long x)
 {
 	unsigned long kernel_start = kernel_map.virt_addr;
-	unsigned long kernel_end = (unsigned long)_end;
+	unsigned long kernel_end = kernel_start + kernel_map.size;
 
 	/*
 	 * Boundary checking aginst the kernel image mapping.
-- 
2.37.4