From: Pavel Tatashin <pasha.tatashin@oracle.com>
To: steven.sistare@oracle.com, daniel.m.jordan@oracle.com,
linux@armlinux.org.uk, schwidefsky@de.ibm.com,
heiko.carstens@de.ibm.com, john.stultz@linaro.org,
sboyd@codeaurora.org, x86@kernel.org,
linux-kernel@vger.kernel.org, mingo@redhat.com,
tglx@linutronix.de, hpa@zytor.com, douly.fnst@cn.fujitsu.com,
peterz@infradead.org, prarit@redhat.com, feng.tang@intel.com,
pmladek@suse.com, gnomes@lxorguk.ukuu.org.uk,
linux-s390@vger.kernel.org, pasha.tatashin@oracle.com,
boris.ostrovsky@oracle.com, jgross@suse.com, pbonzini@redhat.com
Subject: [PATCH v14 09/25] x86: text_poke() may access uninitialized struct pages
Date: Tue, 17 Jul 2018 22:21:55 -0400 [thread overview]
Message-ID: <20180718022211.6259-10-pasha.tatashin@oracle.com> (raw)
In-Reply-To: <20180718022211.6259-1-pasha.tatashin@oracle.com>
It supposed to be safe to modify static branches after jump_label_init().
But, because static key modifying code eventually calls text_poke() we
may end up with accessing struct page that have not been initialized.
Here is how to quickly reproduce the problem. Insert code like this
into init/main.c:
| +static DEFINE_STATIC_KEY_FALSE(__test);
| asmlinkage __visible void __init start_kernel(void)
| {
| char *command_line;
|@@ -587,6 +609,10 @@ asmlinkage __visible void __init start_kernel(void)
| vfs_caches_init_early();
| sort_main_extable();
| trap_init();
|+ {
|+ static_branch_enable(&__test);
|+ WARN_ON(!static_branch_likely(&__test));
|+ }
| mm_init();
The following warnings show-up:
WARNING: CPU: 0 PID: 0 at arch/x86/kernel/alternative.c:701 text_poke+0x20d/0x230
Modules linked in:
CPU: 0 PID: 0 Comm: swapper Not tainted 4.18.0-rc1_pt_t1 #30
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
1.11.0-20171110_100015-anatol 04/01/2014
RIP: 0010:text_poke+0x20d/0x230
Code: 0f 0b 4c 89 e2 4c 89 ee 4c 89 f7 e8 7d 4b 9b 00 31 d2 31 f6 bf 86 02
00 00 48 8b 05 95 8e 24 01 e8 78 18 d8 00 e9 55 ff ff ff <0f> 0b e9 54 fe
ff ff 48 8b 05 75 a8 38 01 e9 64 fe ff ff 48 8b 1d
RSP: 0000:ffffffff94e03e30 EFLAGS: 00010046
RAX: 0100000000000000 RBX: fffff7b2c011f300 RCX: ffffffff94fcccf4
RDX: 0000000000000001 RSI: ffffffff94e03e77 RDI: ffffffff94fcccef
RBP: ffffffff94fcccef R08: 00000000fffffe00 R09: 00000000000000a0
R10: 0000000000000000 R11: 0000000000000040 R12: 0000000000000001
R13: ffffffff94e03e77 R14: ffffffff94fcdcef R15: fffff7b2c0000000
FS: 0000000000000000(0000) GS:ffff9adc87c00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffff9adc8499d000 CR3: 000000000460a001 CR4: 00000000000606b0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
? start_kernel+0x23e/0x4c8
? start_kernel+0x23f/0x4c8
? text_poke_bp+0x50/0xda
? arch_jump_label_transform+0x89/0xe0
? __jump_label_update+0x78/0xb0
? static_key_enable_cpuslocked+0x4d/0x80
? static_key_enable+0x11/0x20
? start_kernel+0x23e/0x4c8
? secondary_startup_64+0xa5/0xb0
---[ end trace abdc99c031b8a90a ]---
If the code above is moved after mm_init(), no warning is shown, as struct
pages are initialized during handover from memblock.
Use text_poke_early() in static branching until early boot IRQs are
enabled, at which time switch to text_poke. Also, ensure text_poke() is
never invoked when unitialized memory access may happen by using:
BUG_ON(!after_bootmem); assertion.
Signed-off-by: Pavel Tatashin <pasha.tatashin@oracle.com>
---
arch/x86/include/asm/text-patching.h | 1 +
arch/x86/kernel/alternative.c | 7 +++++++
arch/x86/kernel/jump_label.c | 11 +++++++----
3 files changed, 15 insertions(+), 4 deletions(-)
diff --git a/arch/x86/include/asm/text-patching.h b/arch/x86/include/asm/text-patching.h
index 2ecd34e2d46c..e85ff65c43c3 100644
--- a/arch/x86/include/asm/text-patching.h
+++ b/arch/x86/include/asm/text-patching.h
@@ -37,5 +37,6 @@ extern void *text_poke_early(void *addr, const void *opcode, size_t len);
extern void *text_poke(void *addr, const void *opcode, size_t len);
extern int poke_int3_handler(struct pt_regs *regs);
extern void *text_poke_bp(void *addr, const void *opcode, size_t len, void *handler);
+extern int after_bootmem;
#endif /* _ASM_X86_TEXT_PATCHING_H */
diff --git a/arch/x86/kernel/alternative.c b/arch/x86/kernel/alternative.c
index a481763a3776..014f214da581 100644
--- a/arch/x86/kernel/alternative.c
+++ b/arch/x86/kernel/alternative.c
@@ -668,6 +668,7 @@ void *__init_or_module text_poke_early(void *addr, const void *opcode,
local_irq_save(flags);
memcpy(addr, opcode, len);
local_irq_restore(flags);
+ sync_core();
/* Could also do a CLFLUSH here to speed up CPU recovery; but
that causes hangs on some VIA CPUs. */
return addr;
@@ -693,6 +694,12 @@ void *text_poke(void *addr, const void *opcode, size_t len)
struct page *pages[2];
int i;
+ /*
+ * While boot memory allocator is runnig we cannot use struct
+ * pages as they are not yet initialized.
+ */
+ BUG_ON(!after_bootmem);
+
if (!core_kernel_text((unsigned long)addr)) {
pages[0] = vmalloc_to_page(addr);
pages[1] = vmalloc_to_page(addr + PAGE_SIZE);
diff --git a/arch/x86/kernel/jump_label.c b/arch/x86/kernel/jump_label.c
index e56c95be2808..eeea935e9bb5 100644
--- a/arch/x86/kernel/jump_label.c
+++ b/arch/x86/kernel/jump_label.c
@@ -37,15 +37,18 @@ static void bug_at(unsigned char *ip, int line)
BUG();
}
-static void __jump_label_transform(struct jump_entry *entry,
- enum jump_label_type type,
- void *(*poker)(void *, const void *, size_t),
- int init)
+static void __ref __jump_label_transform(struct jump_entry *entry,
+ enum jump_label_type type,
+ void *(*poker)(void *, const void *, size_t),
+ int init)
{
union jump_code_union code;
const unsigned char default_nop[] = { STATIC_KEY_INIT_NOP };
const unsigned char *ideal_nop = ideal_nops[NOP_ATOMIC5];
+ if (early_boot_irqs_disabled)
+ poker = text_poke_early;
+
if (type == JUMP_LABEL_JMP) {
if (init) {
/*
--
2.18.0
next prev parent reply other threads:[~2018-07-18 2:24 UTC|newest]
Thread overview: 44+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-07-18 2:21 [PATCH v14 00/25] Early boot time stamps Pavel Tatashin
2018-07-18 2:21 ` [PATCH v14 01/25] x86/kvmclock: Remove memblock dependency Pavel Tatashin
2018-07-18 2:21 ` [PATCH v14 02/25] x86/kvmclock: Remove page size requirement from wall_clock Pavel Tatashin
2018-07-18 2:21 ` [PATCH v14 03/25] x86/kvmclock: Decrapify kvm_register_clock() Pavel Tatashin
2018-07-18 2:21 ` [PATCH v14 04/25] x86/kvmclock: Cleanup the code Pavel Tatashin
2018-07-18 2:21 ` [PATCH v14 05/25] x86/kvmclock: Mark variables __initdata and __ro_after_init Pavel Tatashin
2018-07-18 2:21 ` [PATCH v14 06/25] x86/kvmclock: Move kvmclock vsyscall param and init to kvmclock Pavel Tatashin
2018-07-18 2:21 ` [PATCH v14 07/25] x86/kvmclock: Switch kvmclock data to a PER_CPU variable Pavel Tatashin
2018-07-18 2:21 ` [PATCH v14 08/25] x86/kvmclock: Avoid TSC recalibration Pavel Tatashin
2018-07-18 11:14 ` Paolo Bonzini
2018-07-18 13:33 ` Pavel Tatashin
2018-07-18 2:21 ` Pavel Tatashin [this message]
2018-07-18 2:21 ` [PATCH v14 10/25] x86: initialize static branching early Pavel Tatashin
2018-07-18 2:21 ` [PATCH v14 11/25] x86/CPU: Call detect_nopl() only on the BSP Pavel Tatashin
2018-07-18 2:21 ` [PATCH v14 12/25] x86/tsc: redefine notsc to behave as tsc=unstable Pavel Tatashin
2018-07-18 2:21 ` [PATCH v14 13/25] x86/xen/time: initialize pv xen time in init_hypervisor_platform Pavel Tatashin
2018-07-18 2:22 ` [PATCH v14 14/25] x86/xen/time: output xen sched_clock time from 0 Pavel Tatashin
2018-07-18 2:22 ` [PATCH v14 15/25] s390/time: add read_persistent_wall_and_boot_offset() Pavel Tatashin
2018-07-18 2:22 ` [PATCH v14 16/25] time: replace read_boot_clock64() with read_persistent_wall_and_boot_offset() Pavel Tatashin
2018-07-18 2:22 ` [PATCH v14 17/25] time: default boot time offset to local_clock() Pavel Tatashin
2018-07-18 2:22 ` [PATCH v14 18/25] s390/time: remove read_boot_clock64() Pavel Tatashin
2018-07-18 2:22 ` [PATCH v14 19/25] ARM/time: " Pavel Tatashin
2018-07-18 2:22 ` [PATCH v14 20/25] x86/tsc: calibrate tsc only once Pavel Tatashin
2018-07-19 5:33 ` Dou Liyang
2018-07-19 6:25 ` Thomas Gleixner
2018-07-19 6:48 ` Dou Liyang
2018-07-19 10:33 ` Peter Zijlstra
2018-07-19 11:01 ` Thomas Gleixner
2018-07-19 15:58 ` Pavel Tatashin
2018-07-19 16:19 ` Thomas Gleixner
2018-07-19 16:49 ` Pavel Tatashin
2018-07-19 18:38 ` Pavel Tatashin
2018-07-19 20:44 ` Thomas Gleixner
2018-07-19 20:46 ` Pavel Tatashin
2018-07-23 9:28 ` Alan Cox
2018-07-18 2:22 ` [PATCH v14 21/25] x86/tsc: initialize cyc2ns when tsc freq. is determined Pavel Tatashin
2018-07-18 2:22 ` [PATCH v14 22/25] x86/tsc: use tsc early Pavel Tatashin
2018-07-18 2:22 ` [PATCH v14 23/25] sched: move sched clock initialization and merge with generic clock Pavel Tatashin
2018-07-18 2:22 ` [PATCH v14 24/25] sched: early boot clock Pavel Tatashin
2018-07-19 10:39 ` Peter Zijlstra
2018-07-19 14:16 ` Pavel Tatashin
2018-07-18 2:22 ` [PATCH v14 25/25] sched: use static key for sched_clock_running Pavel Tatashin
2018-07-19 10:48 ` Peter Zijlstra
2018-07-19 14:24 ` Pavel Tatashin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20180718022211.6259-10-pasha.tatashin@oracle.com \
--to=pasha.tatashin@oracle.com \
--cc=boris.ostrovsky@oracle.com \
--cc=daniel.m.jordan@oracle.com \
--cc=douly.fnst@cn.fujitsu.com \
--cc=feng.tang@intel.com \
--cc=gnomes@lxorguk.ukuu.org.uk \
--cc=heiko.carstens@de.ibm.com \
--cc=hpa@zytor.com \
--cc=jgross@suse.com \
--cc=john.stultz@linaro.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-s390@vger.kernel.org \
--cc=linux@armlinux.org.uk \
--cc=mingo@redhat.com \
--cc=pbonzini@redhat.com \
--cc=peterz@infradead.org \
--cc=pmladek@suse.com \
--cc=prarit@redhat.com \
--cc=sboyd@codeaurora.org \
--cc=schwidefsky@de.ibm.com \
--cc=steven.sistare@oracle.com \
--cc=tglx@linutronix.de \
--cc=x86@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).