# git rev-parse -q --verify 478036c4cd1a16e613a2f883d79c03cf187faacb^{commit} 478036c4cd1a16e613a2f883d79c03cf187faacb already have revision, skipping fetch # git checkout -q -f -B kisskb 478036c4cd1a16e613a2f883d79c03cf187faacb # git clean -qxdf # < git log -1 # commit 478036c4cd1a16e613a2f883d79c03cf187faacb # Author: Michael Ellerman # Date: Mon Jun 14 23:14:40 2021 +1000 # # powerpc: Fix initrd corruption with relative jump labels # # Commit b0b3b2c78ec0 ("powerpc: Switch to relative jump labels") switched # us to using relative jump labels. That involves changing the code, # target and key members in struct jump_entry to be relative to the # address of the jump_entry, rather than absolute addresses. # # We have two static inlines that create a struct jump_entry, # arch_static_branch() and arch_static_branch_jump(), as well as an asm # macro ARCH_STATIC_BRANCH, which is used by the pseries-only hypervisor # tracing code. # # Unfortunately we missed updating the key to be a relative reference in # ARCH_STATIC_BRANCH. # # That causes a pseries kernel to have a handful of jump_entry structs # with bad key values. Instead of being a relative reference they instead # hold the full address of the key. # # However the code doesn't expect that, it still adds the key value to the # address of the jump_entry (see jump_entry_key()) expecting to get a # pointer to a key somewhere in kernel data. # # The table of jump_entry structs sits in rodata, which comes after the # kernel text. In a typical build this will be somewhere around 15MB. The # address of the key will be somewhere in data, typically around 20MB. # Adding the two values together gets us a pointer somewhere around 45MB. # # We then call static_key_set_entries() with that bad pointer and modify # some members of the struct static_key we think we are pointing at. # # A pseries kernel is typically ~30MB in size, so writing to ~45MB won't # corrupt the kernel itself. However if we're booting with an initrd, # depending on the size and exact location of the initrd, we can corrupt # the initrd. Depending on how exactly we corrupt the initrd it can either # cause the system to not boot, or just corrupt one of the files in the # initrd. # # The fix is simply to make the key value relative to the jump_entry # struct in the ARCH_STATIC_BRANCH macro. # # Fixes: b0b3b2c78ec0 ("powerpc: Switch to relative jump labels") # Reported-by: Anastasia Kovaleva # Reported-by: Roman Bolshakov # Reported-by: Greg Kurz # Reported-by: Daniel Axtens # Signed-off-by: Michael Ellerman # Tested-by: Daniel Axtens # Tested-by: Greg Kurz # Signed-off-by: Michael Ellerman # Link: https://lore.kernel.org/r/20210614131440.312360-1-mpe@ellerman.id.au # < /opt/cross/kisskb/korg/gcc-8.1.0-nolibc/m68k-linux/bin/m68k-linux-gcc --version # < /opt/cross/kisskb/korg/gcc-8.1.0-nolibc/m68k-linux/bin/m68k-linux-ld --version # < git log --format=%s --max-count=1 478036c4cd1a16e613a2f883d79c03cf187faacb # < make -s -j 24 ARCH=m68k O=/kisskb/build/powerpc-fixes_m68k-defconfig_m68k-gcc8 CROSS_COMPILE=/opt/cross/kisskb/korg/gcc-8.1.0-nolibc/m68k-linux/bin/m68k-linux- defconfig # < make -s -j 24 ARCH=m68k O=/kisskb/build/powerpc-fixes_m68k-defconfig_m68k-gcc8 CROSS_COMPILE=/opt/cross/kisskb/korg/gcc-8.1.0-nolibc/m68k-linux/bin/m68k-linux- help # make -s -j 24 ARCH=m68k O=/kisskb/build/powerpc-fixes_m68k-defconfig_m68k-gcc8 CROSS_COMPILE=/opt/cross/kisskb/korg/gcc-8.1.0-nolibc/m68k-linux/bin/m68k-linux- olddefconfig # make -s -j 24 ARCH=m68k O=/kisskb/build/powerpc-fixes_m68k-defconfig_m68k-gcc8 CROSS_COMPILE=/opt/cross/kisskb/korg/gcc-8.1.0-nolibc/m68k-linux/bin/m68k-linux- /kisskb/src/arch/m68k/mvme147/config.c: In function 'mvme147_hwclk': /kisskb/src/arch/m68k/mvme147/config.c:174:2: warning: #warning check me! [-Wcpp] #warning check me! ^~~~~~~ /kisskb/src/arch/m68k/mvme16x/config.c: In function 'mvme16x_hwclk': /kisskb/src/arch/m68k/mvme16x/config.c:439:2: warning: #warning check me! [-Wcpp] #warning check me! ^~~~~~~ In file included from /kisskb/src/drivers/net/ethernet/8390/xsurf100.c:48: /kisskb/src/drivers/net/ethernet/8390/lib8390.c:995:27: warning: '____alloc_ei_netdev' defined but not used [-Wunused-function] static struct net_device *____alloc_ei_netdev(int size) ^~~~~~~~~~~~~~~~~~~ /kisskb/src/drivers/net/ethernet/8390/lib8390.c:957:13: warning: '__ei_set_multicast_list' defined but not used [-Wunused-function] static void __ei_set_multicast_list(struct net_device *dev) ^~~~~~~~~~~~~~~~~~~~~~~ /kisskb/src/drivers/net/ethernet/8390/lib8390.c:857:33: warning: '__ei_get_stats' defined but not used [-Wunused-function] static struct net_device_stats *__ei_get_stats(struct net_device *dev) ^~~~~~~~~~~~~~ /kisskb/src/drivers/net/ethernet/8390/lib8390.c:512:13: warning: '__ei_poll' defined but not used [-Wunused-function] static void __ei_poll(struct net_device *dev) ^~~~~~~~~ /kisskb/src/drivers/net/ethernet/8390/lib8390.c:303:20: warning: '__ei_start_xmit' defined but not used [-Wunused-function] static netdev_tx_t __ei_start_xmit(struct sk_buff *skb, ^~~~~~~~~~~~~~~ /kisskb/src/drivers/net/ethernet/8390/lib8390.c:257:13: warning: '__ei_tx_timeout' defined but not used [-Wunused-function] static void __ei_tx_timeout(struct net_device *dev, unsigned int txqueue) ^~~~~~~~~~~~~~~ /kisskb/src/drivers/net/ethernet/8390/lib8390.c:233:12: warning: '__ei_close' defined but not used [-Wunused-function] static int __ei_close(struct net_device *dev) ^~~~~~~~~~ /kisskb/src/drivers/net/ethernet/8390/lib8390.c:204:12: warning: '__ei_open' defined but not used [-Wunused-function] static int __ei_open(struct net_device *dev) ^~~~~~~~~ /kisskb/src/drivers/i2c/busses/i2c-icy.c: In function 'icy_probe': /kisskb/src/drivers/i2c/busses/i2c-icy.c:126:24: warning: unused variable 'new_fwnode' [-Wunused-variable] struct fwnode_handle *new_fwnode; ^~~~~~~~~~ Completed OK # rm -rf /kisskb/build/powerpc-fixes_m68k-defconfig_m68k-gcc8 # Build took: 0:02:44.406220