# git rev-parse -q --verify b1ad106c02e19d81927b5a522167780525569490^{commit} # git fetch -q -n -f git://gitlab.ozlabs.ibm.com/linuxppc/linux.git fixes-test # git rev-parse -q --verify b1ad106c02e19d81927b5a522167780525569490^{commit} b1ad106c02e19d81927b5a522167780525569490 # git checkout -q -f -B kisskb b1ad106c02e19d81927b5a522167780525569490 # git clean -qxdf # < git log -1 # commit b1ad106c02e19d81927b5a522167780525569490 # Author: Michael Ellerman # Date: Tue Mar 3 23:28:47 2020 +1100 # # powerpc/mm: Fix missing KUAP disable in flush_coherent_icache() # # We received a report of strange kernel faults which turned out to be # due to a missing KUAP disable in flush_coherent_icache() called # from flush_icache_range(). # # The fault looks like: # # Kernel attempted to access user page (7fffc30d9c00) - exploit attempt? (uid: 1009) # BUG: Unable to handle kernel data access on read at 0x7fffc30d9c00 # Faulting instruction address: 0xc00000000007232c # Oops: Kernel access of bad area, sig: 11 [#1] # LE PAGE_SIZE=64K MMU=Radix SMP NR_CPUS=2048 NUMA PowerNV # CPU: 35 PID: 5886 Comm: sigtramp Not tainted 5.6.0-rc2-gcc-8.2.0-00003-gfc37a1632d40 #79 # NIP: c00000000007232c LR: c00000000003b7fc CTR: 0000000000000000 # REGS: c000001e11093940 TRAP: 0300 Not tainted (5.6.0-rc2-gcc-8.2.0-00003-gfc37a1632d40) # MSR: 900000000280b033 CR: 28000884 XER: 00000000 # CFAR: c0000000000722fc DAR: 00007fffc30d9c00 DSISR: 08000000 IRQMASK: 0 # GPR00: c00000000003b7fc c000001e11093bd0 c0000000023ac200 00007fffc30d9c00 # GPR04: 00007fffc30d9c18 0000000000000000 c000001e11093bd4 0000000000000000 # GPR08: 0000000000000000 0000000000000001 0000000000000000 c000001e1104ed80 # GPR12: 0000000000000000 c000001fff6ab380 c0000000016be2d0 4000000000000000 # GPR16: c000000000000000 bfffffffffffffff 0000000000000000 0000000000000000 # GPR20: 00007fffc30d9c00 00007fffc30d8f58 00007fffc30d9c18 00007fffc30d9c20 # GPR24: 00007fffc30d9c18 0000000000000000 c000001e11093d90 c000001e1104ed80 # GPR28: c000001e11093e90 0000000000000000 c0000000023d9d18 00007fffc30d9c00 # NIP flush_icache_range+0x5c/0x80 # LR handle_rt_signal64+0x95c/0xc2c # Call Trace: # 0xc000001e11093d90 (unreliable) # handle_rt_signal64+0x93c/0xc2c # do_notify_resume+0x310/0x430 # ret_from_except_lite+0x70/0x74 # Instruction dump: # 409e002c 7c0802a6 3c62ff31 3863f6a0 f8010080 48195fed 60000000 48fe4c8d # 60000000 e8010080 7c0803a6 7c0004ac <7c00ffac> 7c0004ac 4c00012c 38210070 # # This path through handle_rt_signal64() to setup_trampoline() and # flush_icache_range() is only triggered by 64-bit processes that have # unmapped their VDSO, which is rare. # # flush_icache_range() takes a range of addresses to flush. In # flush_coherent_icache() we implement an optimisation for CPUs where we # know we don't actually have to flush the whole range, we just need to # do a single icbi. # # However we still execute the icbi on the user address of the start of # the range we're flushing. On CPUs that also implement KUAP (Power9) # that leads to the spurious fault above. # # We should be able to pass any address, including a kernel address, to # the icbi on these CPUs, which would avoid any interaction with KUAP. # But I don't want to make that change in a bug fix, just in case it # surfaces some strange behaviour on some CPU. # # So for now just disable KUAP around the icbi. Note the icbi is treated # as a load, so we allow read access, not write as you'd expect. # # Fixes: 890274c2dc4c ("powerpc/64s: Implement KUAP for Radix MMU") # Cc: stable@vger.kernel.org # v5.2+ # Signed-off-by: Michael Ellerman # < /opt/cross/kisskb/korg/gcc-8.1.0-nolibc/m68k-linux/bin/m68k-linux-gcc --version # < /opt/cross/kisskb/korg/gcc-8.1.0-nolibc/m68k-linux/bin/m68k-linux-ld --version # < git log --format=%s --max-count=1 b1ad106c02e19d81927b5a522167780525569490 # < make -s -j 24 ARCH=m68k O=/kisskb/build/powerpc-fixes_m68k-defconfig_m68k-gcc8 CROSS_COMPILE=/opt/cross/kisskb/korg/gcc-8.1.0-nolibc/m68k-linux/bin/m68k-linux- defconfig # < make -s -j 24 ARCH=m68k O=/kisskb/build/powerpc-fixes_m68k-defconfig_m68k-gcc8 CROSS_COMPILE=/opt/cross/kisskb/korg/gcc-8.1.0-nolibc/m68k-linux/bin/m68k-linux- help # make -s -j 24 ARCH=m68k O=/kisskb/build/powerpc-fixes_m68k-defconfig_m68k-gcc8 CROSS_COMPILE=/opt/cross/kisskb/korg/gcc-8.1.0-nolibc/m68k-linux/bin/m68k-linux- olddefconfig # make -s -j 24 ARCH=m68k O=/kisskb/build/powerpc-fixes_m68k-defconfig_m68k-gcc8 CROSS_COMPILE=/opt/cross/kisskb/korg/gcc-8.1.0-nolibc/m68k-linux/bin/m68k-linux- In file included from /kisskb/src/arch/m68k/include/asm/amigayle.h:21, from /kisskb/src/arch/m68k/include/asm/io_mm.h:59, from /kisskb/src/arch/m68k/include/asm/io.h:8, from /kisskb/src/include/linux/clocksource.h:21, from /kisskb/src/arch/m68k/amiga/config.c:20: /kisskb/src/arch/m68k/amiga/config.c: In function 'amiga_identify': /kisskb/src/arch/m68k/include/asm/amigahw.h:42:50: warning: this statement may fall through [-Wimplicit-fallthrough=] #define AMIGAHW_SET(name) (amiga_hw_present.name = 1) ~~~~~~~~~~~~~~~~~~~~~~~^~~~ /kisskb/src/arch/m68k/amiga/config.c:223:3: note: in expansion of macro 'AMIGAHW_SET' AMIGAHW_SET(PCMCIA); ^~~~~~~~~~~ /kisskb/src/arch/m68k/amiga/config.c:224:2: note: here case AMI_500: ^~~~ /kisskb/src/arch/m68k/mvme147/config.c: In function 'mvme147_hwclk': /kisskb/src/arch/m68k/mvme147/config.c:175:2: warning: #warning check me! [-Wcpp] #warning check me! ^~~~~~~ /kisskb/src/arch/m68k/mvme16x/config.c: In function 'mvme16x_hwclk': /kisskb/src/arch/m68k/mvme16x/config.c:440:2: warning: #warning check me! [-Wcpp] #warning check me! ^~~~~~~ In file included from /kisskb/src/arch/m68k/include/asm/atomic.h:7, from /kisskb/src/include/linux/atomic.h:7, from /kisskb/src/include/linux/spinlock.h:445, from /kisskb/src/include/linux/seqlock.h:36, from /kisskb/src/include/linux/time.h:6, from /kisskb/src/include/linux/stat.h:19, from /kisskb/src/include/linux/module.h:13, from /kisskb/src/net/core/filter.c:20: /kisskb/src/net/core/filter.c: In function 'bpf_clear_redirect_map': /kisskb/src/arch/m68k/include/asm/cmpxchg.h:137:3: warning: value computed is not used [-Wunused-value] ((__typeof__(*(ptr)))__cmpxchg_local_generic((ptr), (unsigned long)(o),\ ~^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ (unsigned long)(n), sizeof(*(ptr)))) ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ /kisskb/src/include/asm-generic/cmpxchg.h:106:28: note: in expansion of macro 'cmpxchg_local' #define cmpxchg(ptr, o, n) cmpxchg_local((ptr), (o), (n)) ^~~~~~~~~~~~~ /kisskb/src/net/core/filter.c:3516:4: note: in expansion of macro 'cmpxchg' cmpxchg(&ri->map, map, NULL); ^~~~~~~ In file included from /kisskb/src/arch/m68k/include/asm/atomic.h:7, from /kisskb/src/include/linux/atomic.h:7, from /kisskb/src/include/linux/spinlock.h:445, from /kisskb/src/include/linux/mmzone.h:8, from /kisskb/src/include/linux/gfp.h:6, from /kisskb/src/include/linux/mm.h:10, from /kisskb/src/kernel/acct.c:47: /kisskb/src/kernel/acct.c: In function 'acct_pin_kill': /kisskb/src/arch/m68k/include/asm/cmpxchg.h:137:3: warning: value computed is not used [-Wunused-value] ((__typeof__(*(ptr)))__cmpxchg_local_generic((ptr), (unsigned long)(o),\ ~^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ (unsigned long)(n), sizeof(*(ptr)))) ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ /kisskb/src/include/asm-generic/cmpxchg.h:106:28: note: in expansion of macro 'cmpxchg_local' #define cmpxchg(ptr, o, n) cmpxchg_local((ptr), (o), (n)) ^~~~~~~~~~~~~ /kisskb/src/kernel/acct.c:177:2: note: in expansion of macro 'cmpxchg' cmpxchg(&acct->ns->bacct, pin, NULL); ^~~~~~~ In file included from /kisskb/src/drivers/net/ethernet/8390/xsurf100.c:48: /kisskb/src/drivers/net/ethernet/8390/lib8390.c:988:27: warning: '____alloc_ei_netdev' defined but not used [-Wunused-function] static struct net_device *____alloc_ei_netdev(int size) ^~~~~~~~~~~~~~~~~~~ /kisskb/src/drivers/net/ethernet/8390/lib8390.c:950:13: warning: '__ei_set_multicast_list' defined but not used [-Wunused-function] static void __ei_set_multicast_list(struct net_device *dev) ^~~~~~~~~~~~~~~~~~~~~~~ /kisskb/src/drivers/net/ethernet/8390/lib8390.c:850:33: warning: '__ei_get_stats' defined but not used [-Wunused-function] static struct net_device_stats *__ei_get_stats(struct net_device *dev) ^~~~~~~~~~~~~~ /kisskb/src/drivers/net/ethernet/8390/lib8390.c:509:13: warning: '__ei_poll' defined but not used [-Wunused-function] static void __ei_poll(struct net_device *dev) ^~~~~~~~~ /kisskb/src/drivers/net/ethernet/8390/lib8390.c:300:20: warning: '__ei_start_xmit' defined but not used [-Wunused-function] static netdev_tx_t __ei_start_xmit(struct sk_buff *skb, ^~~~~~~~~~~~~~~ /kisskb/src/drivers/net/ethernet/8390/lib8390.c:254:13: warning: '__ei_tx_timeout' defined but not used [-Wunused-function] static void __ei_tx_timeout(struct net_device *dev, unsigned int txqueue) ^~~~~~~~~~~~~~~ /kisskb/src/drivers/net/ethernet/8390/lib8390.c:230:12: warning: '__ei_close' defined but not used [-Wunused-function] static int __ei_close(struct net_device *dev) ^~~~~~~~~~ /kisskb/src/drivers/net/ethernet/8390/lib8390.c:201:12: warning: '__ei_open' defined but not used [-Wunused-function] static int __ei_open(struct net_device *dev) ^~~~~~~~~ In file included from /kisskb/src/arch/m68k/include/asm/atomic.h:7, from /kisskb/src/include/linux/atomic.h:7, from /kisskb/src/include/linux/spinlock.h:445, from /kisskb/src/include/linux/wait.h:9, from /kisskb/src/include/linux/wait_bit.h:8, from /kisskb/src/include/linux/fs.h:6, from /kisskb/src/fs/ocfs2/file.c:13: /kisskb/src/fs/ocfs2/file.c: In function 'ocfs2_file_write_iter': /kisskb/src/arch/m68k/include/asm/cmpxchg.h:79:22: warning: value computed is not used [-Wunused-value] #define xchg(ptr,x) ((__typeof__(*(ptr)))__xchg((unsigned long)(x),(ptr),sizeof(*(ptr)))) ~^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ /kisskb/src/fs/ocfs2/file.c:2419:3: note: in expansion of macro 'xchg' xchg(&iocb->ki_complete, saved_ki_complete); ^~~~ In file included from /kisskb/src/arch/m68k/include/asm/atomic.h:7, from /kisskb/src/include/linux/atomic.h:7, from /kisskb/src/include/linux/spinlock.h:445, from /kisskb/src/include/linux/mmzone.h:8, from /kisskb/src/include/linux/gfp.h:6, from /kisskb/src/include/linux/slab.h:15, from /kisskb/src/fs/posix_acl.c:15: /kisskb/src/fs/posix_acl.c: In function 'get_acl': /kisskb/src/arch/m68k/include/asm/cmpxchg.h:137:3: warning: value computed is not used [-Wunused-value] ((__typeof__(*(ptr)))__cmpxchg_local_generic((ptr), (unsigned long)(o),\ ~^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ (unsigned long)(n), sizeof(*(ptr)))) ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ /kisskb/src/include/asm-generic/cmpxchg.h:106:28: note: in expansion of macro 'cmpxchg_local' #define cmpxchg(ptr, o, n) cmpxchg_local((ptr), (o), (n)) ^~~~~~~~~~~~~ /kisskb/src/fs/posix_acl.c:148:3: note: in expansion of macro 'cmpxchg' cmpxchg(p, sentinel, ACL_NOT_CACHED); ^~~~~~~ Completed OK # rm -rf /kisskb/build/powerpc-fixes_m68k-defconfig_m68k-gcc8 # Build took: 0:02:30.850378