On Mon, 2018-10-08 at 15:28 +0200, gregkh@linuxfoundation.org wrote:

The patch below does not apply to the 4.14-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to stable@vger.kernel.org.

Just repeating here what christophe said in the other thread....

--- Thanks,

Looks like 4.14 is missing commit 8cf4c05712f0 ("powerpc/lib/code-patching: refactor patch_instruction()"), is that acceptable for you to take that one too ?

[root@localhost linux-stable]# git checkout 4.14.y -b test Switched to a new branch 'test' [root@localhost linux-stable]# git cherry-pick 8cf4c05712f04a405f0dacebcca8f042b391694a [test 7a0d0e13888a] powerpc/lib/code-patching: refactor patch_instruction() Date: Fri Nov 24 08:31:07 2017 +0100 1 file changed, 15 insertions(+), 15 deletions(-) [root@localhost linux-stable]# git cherry-pick 51c3c62b58b357e8d35e4cc32f7b4ec907426fe3 [test f08071c8ffde] powerpc: Avoid code patching freed init sections Author: Michael Neuling mikey@neuling.org Date: Fri Sep 14 11:14:11 2018 +1000 3 files changed, 9 insertions(+) [root@localhost linux-stable]# git cherry-pick b45ba4a51cde29b2939365ef0c07ad34c8321789 [test 2daecf52d401] powerpc/lib: fix book3s/32 boot failure due to code patching Date: Mon Oct 1 12:21:10 2018 +0000 1 file changed, 12 insertions(+), 8 deletions(-)

Christophe

thanks,

greg k-h

------------------ original commit in Linus's tree ------------------

...

From 51c3c62b58b357e8d35e4cc32f7b4ec907426fe3 Mon Sep 17 00:00:00 2001

From: Michael Neuling mikey@neuling.org Date: Fri, 14 Sep 2018 11:14:11 +1000 Subject: [PATCH] powerpc: Avoid code patching freed init sections

This stops us from doing code patching in init sections after they've been freed.

In this chain: kvm_guest_init() -> kvm_use_magic_page() -> fault_in_pages_readable() -> __get_user() -> __get_user_nocheck() -> barrier_nospec();

We have a code patching location at barrier_nospec() and kvm_guest_init() is an init function. This whole chain gets inlined, so when we free the init section (hence kvm_guest_init()), this code goes away and hence should no longer be patched.

We seen this as userspace memory corruption when using a memory checker while doing partition migration testing on powervm (this starts the code patching post migration via /sys/kernel/mobility/migration). In theory, it could also happen when using /sys/kernel/debug/powerpc/barrier_nospec.

Cc: stable@vger.kernel.org # 4.13+ Signed-off-by: Michael Neuling mikey@neuling.org Reviewed-by: Nicholas Piggin npiggin@gmail.com Reviewed-by: Christophe Leroy christophe.leroy@c-s.fr Signed-off-by: Michael Ellerman mpe@ellerman.id.au

diff --git a/arch/powerpc/include/asm/setup.h b/arch/powerpc/include/asm/setup.h index 1a951b00465d..1fffbba8d6a5 100644 --- a/arch/powerpc/include/asm/setup.h +++ b/arch/powerpc/include/asm/setup.h @@ -9,6 +9,7 @@ extern void ppc_printk_progress(char *s, unsigned short hex); extern unsigned int rtas_data; extern unsigned long long memory_limit; +extern bool init_mem_is_free; extern unsigned long klimit; extern void *zalloc_maybe_bootmem(size_t size, gfp_t mask); diff --git a/arch/powerpc/lib/code-patching.c b/arch/powerpc/lib/code- patching.c index 850f3b8f4da5..6ae2777c220d 100644 --- a/arch/powerpc/lib/code-patching.c +++ b/arch/powerpc/lib/code-patching.c @@ -28,6 +28,12 @@ static int __patch_instruction(unsigned int *exec_addr, unsigned int instr, { int err;

• /* Make sure we aren't patching a freed init section */
• if (init_mem_is_free && init_section_contains(exec_addr, 4)) {

• pr_debug("Skipping init section patching addr: 0x%px\n",
  

exec_addr);

• return 0;
  

• }
• __put_user_size(instr, patch_addr, 4, err); if (err) return err;

diff --git a/arch/powerpc/mm/mem.c b/arch/powerpc/mm/mem.c index 5c8530d0c611..04ccb274a620 100644 --- a/arch/powerpc/mm/mem.c +++ b/arch/powerpc/mm/mem.c @@ -63,6 +63,7 @@ #endif unsigned long long memory_limit; +bool init_mem_is_free; #ifdef CONFIG_HIGHMEM pte_t *kmap_pte; @@ -396,6 +397,7 @@ void free_initmem(void) { ppc_md.progress = ppc_printk_progress; mark_initmem_nx();

• init_mem_is_free = true; free_initmem_default(POISON_FREE_INITMEM);

}