linux-kernel - [PATCH] ARM: mm: fix stack corruption when CONFIG_ARM_PV

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20230907143302.4940-1-zhizhou.zh@gmail.com>
Date:   Thu,  7 Sep 2023 22:33:02 +0800
From:   Zhizhou Zhang <zhizhou.zh@...il.com>
To:     linux@...linux.org.uk, rmk+kernel@...linux.org.uk, rppt@...nel.org,
        linus.walleij@...aro.org, akpm@...ux-foundation.org,
        vishal.moola@...il.com, arnd@...db.de, wangkefeng.wang@...wei.com,
        willy@...radead.org
Cc:     linux-arm-kernel@...ts.infradead.org, linux-kernel@...r.kernel.org,
        Zhizhou Zhang <zhizhouzhang@...micro.com>
Subject: [PATCH] ARM: mm: fix stack corruption when CONFIG_ARM_PV_FIXUP=y

From: Zhizhou Zhang <zhizhouzhang@...micro.com>

flush_cache_all() save registers to stack at function entry.
If it's called after cache disabled, the data is written to
memory directly. So the following clean cache operation corrupted
registers saved by flush_cache_all(), including lr register.
calling flush_cache_all() before turn off cache fixed the problem.

Signed-off-by: Zhizhou Zhang <zhizhouzhang@...micro.com>
---
 arch/arm/mm/mmu.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm/mm/mmu.c b/arch/arm/mm/mmu.c
index 674ed71573a8..03fb0fe926f3 100644
--- a/arch/arm/mm/mmu.c
+++ b/arch/arm/mm/mmu.c
@@ -1675,6 +1675,7 @@ static void __init early_paging_init(const struct machine_desc *mdesc)
 	/* Run the patch stub to update the constants */
 	fixup_pv_table(&__pv_table_begin,
 		(&__pv_table_end - &__pv_table_begin) << 2);
+	flush_cache_all();
 
 	/*
 	 * We changing not only the virtual to physical mapping, but also
@@ -1690,7 +1691,6 @@ static void __init early_paging_init(const struct machine_desc *mdesc)
 	asm("mrc p15, 0, %0, c2, c0, 2" : "=r" (ttbcr));
 	asm volatile("mcr p15, 0, %0, c2, c0, 2"
 		: : "r" (ttbcr & ~(3 << 8 | 3 << 10)));
-	flush_cache_all();
 
 	/*
 	 * Fixup the page tables - this must be in the idmap region as
-- 
2.34.1