# git rev-parse -q --verify 478036c4cd1a16e613a2f883d79c03cf187faacb^{commit} 478036c4cd1a16e613a2f883d79c03cf187faacb already have revision, skipping fetch # git checkout -q -f -B kisskb 478036c4cd1a16e613a2f883d79c03cf187faacb # git clean -qxdf # < git log -1 # commit 478036c4cd1a16e613a2f883d79c03cf187faacb # Author: Michael Ellerman # Date: Mon Jun 14 23:14:40 2021 +1000 # # powerpc: Fix initrd corruption with relative jump labels # # Commit b0b3b2c78ec0 ("powerpc: Switch to relative jump labels") switched # us to using relative jump labels. That involves changing the code, # target and key members in struct jump_entry to be relative to the # address of the jump_entry, rather than absolute addresses. # # We have two static inlines that create a struct jump_entry, # arch_static_branch() and arch_static_branch_jump(), as well as an asm # macro ARCH_STATIC_BRANCH, which is used by the pseries-only hypervisor # tracing code. # # Unfortunately we missed updating the key to be a relative reference in # ARCH_STATIC_BRANCH. # # That causes a pseries kernel to have a handful of jump_entry structs # with bad key values. Instead of being a relative reference they instead # hold the full address of the key. # # However the code doesn't expect that, it still adds the key value to the # address of the jump_entry (see jump_entry_key()) expecting to get a # pointer to a key somewhere in kernel data. # # The table of jump_entry structs sits in rodata, which comes after the # kernel text. In a typical build this will be somewhere around 15MB. The # address of the key will be somewhere in data, typically around 20MB. # Adding the two values together gets us a pointer somewhere around 45MB. # # We then call static_key_set_entries() with that bad pointer and modify # some members of the struct static_key we think we are pointing at. # # A pseries kernel is typically ~30MB in size, so writing to ~45MB won't # corrupt the kernel itself. However if we're booting with an initrd, # depending on the size and exact location of the initrd, we can corrupt # the initrd. Depending on how exactly we corrupt the initrd it can either # cause the system to not boot, or just corrupt one of the files in the # initrd. # # The fix is simply to make the key value relative to the jump_entry # struct in the ARCH_STATIC_BRANCH macro. # # Fixes: b0b3b2c78ec0 ("powerpc: Switch to relative jump labels") # Reported-by: Anastasia Kovaleva # Reported-by: Roman Bolshakov # Reported-by: Greg Kurz # Reported-by: Daniel Axtens # Signed-off-by: Michael Ellerman # Tested-by: Daniel Axtens # Tested-by: Greg Kurz # Signed-off-by: Michael Ellerman # Link: https://lore.kernel.org/r/20210614131440.312360-1-mpe@ellerman.id.au # < /opt/cross/kisskb/korg/gcc-5.5.0-nolibc/powerpc64-linux/bin/powerpc64-linux-gcc --version # < /opt/cross/kisskb/korg/gcc-5.5.0-nolibc/powerpc64-linux/bin/powerpc64-linux-ld --version # < git log --format=%s --max-count=1 478036c4cd1a16e613a2f883d79c03cf187faacb # < make -s -j 32 ARCH=powerpc O=/kisskb/build/powerpc-fixes_ps3_defconfig_powerpc-gcc5 CROSS_COMPILE=/opt/cross/kisskb/korg/gcc-5.5.0-nolibc/powerpc64-linux/bin/powerpc64-linux- ps3_defconfig # < make -s -j 32 ARCH=powerpc O=/kisskb/build/powerpc-fixes_ps3_defconfig_powerpc-gcc5 CROSS_COMPILE=/opt/cross/kisskb/korg/gcc-5.5.0-nolibc/powerpc64-linux/bin/powerpc64-linux- help # make -s -j 32 ARCH=powerpc O=/kisskb/build/powerpc-fixes_ps3_defconfig_powerpc-gcc5 CROSS_COMPILE=/opt/cross/kisskb/korg/gcc-5.5.0-nolibc/powerpc64-linux/bin/powerpc64-linux- olddefconfig # make -s -j 32 ARCH=powerpc O=/kisskb/build/powerpc-fixes_ps3_defconfig_powerpc-gcc5 CROSS_COMPILE=/opt/cross/kisskb/korg/gcc-5.5.0-nolibc/powerpc64-linux/bin/powerpc64-linux- Completed OK # rm -rf /kisskb/build/powerpc-fixes_ps3_defconfig_powerpc-gcc5 # Build took: 0:01:55.384829