| From 90f624d7f8de63fa8f6ed976cfd6f2a23eb6b7a7 Mon Sep 17 00:00:00 2001 |
| From: Sasha Levin <sashal@kernel.org> |
| Date: Mon, 28 Jun 2021 13:24:10 +0200 |
| Subject: jump_label: Fix jump_label_text_reserved() vs __init |
| |
| From: Peter Zijlstra <peterz@infradead.org> |
| |
| [ Upstream commit 9e667624c291753b8a5128f620f493d0b5226063 ] |
| |
| It turns out that jump_label_text_reserved() was reporting __init text |
| as being reserved past the time when the __init text was freed and |
| re-used. |
| |
| For a long time, this resulted in, at worst, not being able to kprobe |
| text that happened to land at the re-used address. However a recent |
| commit e7bf1ba97afd ("jump_label, x86: Emit short JMP") made it a |
| fatal mistake because it now needs to read the instruction in order to |
| determine the conflict -- an instruction that's no longer there. |
| |
| Fixes: 4c3ef6d79328 ("jump label: Add jump_label_text_reserved() to reserve jump points") |
| Reported-by: kernel test robot <oliver.sang@intel.com> |
| Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> |
| Signed-off-by: Ingo Molnar <mingo@kernel.org> |
| Reviewed-by: Masami Hiramatsu <mhiramat@kernel.org> |
| Link: https://lore.kernel.org/r/20210628113045.045141693@infradead.org |
| Signed-off-by: Sasha Levin <sashal@kernel.org> |
| --- |
| kernel/jump_label.c | 13 ++++++++----- |
| 1 file changed, 8 insertions(+), 5 deletions(-) |
| |
| diff --git a/kernel/jump_label.c b/kernel/jump_label.c |
| index ba39fbb1f8e7..af520ca26360 100644 |
| --- a/kernel/jump_label.c |
| +++ b/kernel/jump_label.c |
| @@ -316,14 +316,16 @@ static int addr_conflict(struct jump_entry *entry, void *start, void *end) |
| } |
| |
| static int __jump_label_text_reserved(struct jump_entry *iter_start, |
| - struct jump_entry *iter_stop, void *start, void *end) |
| + struct jump_entry *iter_stop, void *start, void *end, bool init) |
| { |
| struct jump_entry *iter; |
| |
| iter = iter_start; |
| while (iter < iter_stop) { |
| - if (addr_conflict(iter, start, end)) |
| - return 1; |
| + if (init || !jump_entry_is_init(iter)) { |
| + if (addr_conflict(iter, start, end)) |
| + return 1; |
| + } |
| iter++; |
| } |
| |
| @@ -561,7 +563,7 @@ static int __jump_label_mod_text_reserved(void *start, void *end) |
| |
| ret = __jump_label_text_reserved(mod->jump_entries, |
| mod->jump_entries + mod->num_jump_entries, |
| - start, end); |
| + start, end, mod->state == MODULE_STATE_COMING); |
| |
| module_put(mod); |
| |
| @@ -786,8 +788,9 @@ early_initcall(jump_label_init_module); |
| */ |
| int jump_label_text_reserved(void *start, void *end) |
| { |
| + bool init = system_state < SYSTEM_RUNNING; |
| int ret = __jump_label_text_reserved(__start___jump_table, |
| - __stop___jump_table, start, end); |
| + __stop___jump_table, start, end, init); |
| |
| if (ret) |
| return ret; |
| -- |
| 2.30.2 |
| |