# git rev-parse -q --verify 478036c4cd1a16e613a2f883d79c03cf187faacb^{commit} 478036c4cd1a16e613a2f883d79c03cf187faacb already have revision, skipping fetch # git checkout -q -f -B kisskb 478036c4cd1a16e613a2f883d79c03cf187faacb # git clean -qxdf # < git log -1 # commit 478036c4cd1a16e613a2f883d79c03cf187faacb # Author: Michael Ellerman # Date: Mon Jun 14 23:14:40 2021 +1000 # # powerpc: Fix initrd corruption with relative jump labels # # Commit b0b3b2c78ec0 ("powerpc: Switch to relative jump labels") switched # us to using relative jump labels. That involves changing the code, # target and key members in struct jump_entry to be relative to the # address of the jump_entry, rather than absolute addresses. # # We have two static inlines that create a struct jump_entry, # arch_static_branch() and arch_static_branch_jump(), as well as an asm # macro ARCH_STATIC_BRANCH, which is used by the pseries-only hypervisor # tracing code. # # Unfortunately we missed updating the key to be a relative reference in # ARCH_STATIC_BRANCH. # # That causes a pseries kernel to have a handful of jump_entry structs # with bad key values. Instead of being a relative reference they instead # hold the full address of the key. # # However the code doesn't expect that, it still adds the key value to the # address of the jump_entry (see jump_entry_key()) expecting to get a # pointer to a key somewhere in kernel data. # # The table of jump_entry structs sits in rodata, which comes after the # kernel text. In a typical build this will be somewhere around 15MB. The # address of the key will be somewhere in data, typically around 20MB. # Adding the two values together gets us a pointer somewhere around 45MB. # # We then call static_key_set_entries() with that bad pointer and modify # some members of the struct static_key we think we are pointing at. # # A pseries kernel is typically ~30MB in size, so writing to ~45MB won't # corrupt the kernel itself. However if we're booting with an initrd, # depending on the size and exact location of the initrd, we can corrupt # the initrd. Depending on how exactly we corrupt the initrd it can either # cause the system to not boot, or just corrupt one of the files in the # initrd. # # The fix is simply to make the key value relative to the jump_entry # struct in the ARCH_STATIC_BRANCH macro. # # Fixes: b0b3b2c78ec0 ("powerpc: Switch to relative jump labels") # Reported-by: Anastasia Kovaleva # Reported-by: Roman Bolshakov # Reported-by: Greg Kurz # Reported-by: Daniel Axtens # Signed-off-by: Michael Ellerman # Tested-by: Daniel Axtens # Tested-by: Greg Kurz # Signed-off-by: Michael Ellerman # Link: https://lore.kernel.org/r/20210614131440.312360-1-mpe@ellerman.id.au # < /opt/cross/kisskb/korg/gcc-4.9.4-nolibc/powerpc64-linux/bin/powerpc64-linux-gcc --version # < /opt/cross/kisskb/korg/gcc-4.9.4-nolibc/powerpc64-linux/bin/powerpc64-linux-ld --version # < git log --format=%s --max-count=1 478036c4cd1a16e613a2f883d79c03cf187faacb # < make -s -j 24 ARCH=powerpc O=/kisskb/build/powerpc-fixes_52xx_tqm5200_defconfig_powerpc-gcc4.9 CROSS_COMPILE=/opt/cross/kisskb/korg/gcc-4.9.4-nolibc/powerpc64-linux/bin/powerpc64-linux- 52xx/tqm5200_defconfig # < make -s -j 24 ARCH=powerpc O=/kisskb/build/powerpc-fixes_52xx_tqm5200_defconfig_powerpc-gcc4.9 CROSS_COMPILE=/opt/cross/kisskb/korg/gcc-4.9.4-nolibc/powerpc64-linux/bin/powerpc64-linux- help # make -s -j 24 ARCH=powerpc O=/kisskb/build/powerpc-fixes_52xx_tqm5200_defconfig_powerpc-gcc4.9 CROSS_COMPILE=/opt/cross/kisskb/korg/gcc-4.9.4-nolibc/powerpc64-linux/bin/powerpc64-linux- olddefconfig # make -s -j 24 ARCH=powerpc O=/kisskb/build/powerpc-fixes_52xx_tqm5200_defconfig_powerpc-gcc4.9 CROSS_COMPILE=/opt/cross/kisskb/korg/gcc-4.9.4-nolibc/powerpc64-linux/bin/powerpc64-linux- /kisskb/src/block/genhd.c: In function 'diskstats_show': /kisskb/src/block/genhd.c:1236:1: warning: the frame size of 1120 bytes is larger than 1024 bytes [-Wframe-larger-than=] } ^ /kisskb/src/net/sched/sch_frag.c: In function 'sch_fragment': /kisskb/src/net/sched/sch_frag.c:93:10: warning: missing braces around initializer [-Wmissing-braces] struct rtable sch_frag_rt = { 0 }; ^ /kisskb/src/net/sched/sch_frag.c:93:10: warning: (near initialization for 'sch_frag_rt.dst') [-Wmissing-braces] INFO: Uncompressed kernel (size 0x74a460) overlaps the address of the wrapper(0x400000) INFO: Fixing the link_address of wrapper to (0x800000) Image Name: Linux-5.13.0-rc2-g478036c4cd1a Created: Thu Jun 17 03:09:47 2021 Image Type: PowerPC Linux Kernel Image (gzip compressed) Data Size: 3323394 Bytes = 3245.50 KiB = 3.17 MiB Load Address: 00000000 Entry Point: 00000000 Completed OK # rm -rf /kisskb/build/powerpc-fixes_52xx_tqm5200_defconfig_powerpc-gcc4.9 # Build took: 0:01:30.685207