From patchwork Tue May 21 21:38:13 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mike Rapoport X-Patchwork-Id: 13669780 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 899CAC25B74 for ; Tue, 21 May 2024 21:38:46 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender: Content-Transfer-Encoding:Content-Type:List-Subscribe:List-Help:List-Post: List-Archive:List-Unsubscribe:List-Id:MIME-Version:Message-ID:Date:Subject:Cc :To:From:Reply-To:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References: List-Owner; bh=Ke8uCVyhRUW3oM+A06LbKJgCAce6YvTuRkKoGf3A914=; b=MiTzEfmEA3k6Xs D/y92OW2aVY+PNK76dJ7lqdLT9teQma+Vq+rpCUD2D+ZeEyW8QoO6nZYg8hw1mT+yWSw6AsWQBb4G Vs84JmqlnR19U5koKsgTm3Pab3Y+tHY46GkdmA6TWAEJJ1cJrvtew2T0YlYeOpOymP+pULHsl5u0A J25Mtch+gUjDodKba6ZtBL/gbmc6b7uWAM9kaxqA18aZ5CDb4TeAW/VAiGRqzp4eHybvY3nEvQ8BY EapEIfl0C6Ap+cxJ1BT0vKdb0rp6DaWmdrTxZjMiEHcwRklEMSVUZphpKzOdS5A3jztesXDUn78f2 TawIMja7QZqEyAkxk9RA==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.97.1 #2 (Red Hat Linux)) id 1s9XBo-00000001BB8-3apX; Tue, 21 May 2024 21:38:32 +0000 Received: from sin.source.kernel.org ([145.40.73.55]) by bombadil.infradead.org with esmtps (Exim 4.97.1 #2 (Red Hat Linux)) id 1s9XBl-00000001BAO-2PnI for linux-arm-kernel@lists.infradead.org; Tue, 21 May 2024 21:38:31 +0000 Received: from smtp.kernel.org (transwarp.subspace.kernel.org [100.75.92.58]) by sin.source.kernel.org (Postfix) with ESMTP id 9DDAACE0F74; Tue, 21 May 2024 21:38:25 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id B2885C2BD11; Tue, 21 May 2024 21:38:22 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1716327504; bh=oR5loQ/i/Rsx1Ierj/b9bxTyVCpBalS4Ej8gyPm7Brc=; h=From:To:Cc:Subject:Date:From; b=aRRWV2mzamYq+493uTYGefAmM60IvfIRY1mQoBMKUKToegUyImYWhjdjer739pp6V rnLAeZBEOgI5p2RLFhbROQW0e5xW/WU5AaADkrJrktemwNy1Gd42o38uGS7RNGotFk 9LojW1/7Wm12ZCDj3gcxlh2CtkxtA8D3RDiG85ZKh5qI9GKvnIOh+vRTlygAg9AaAQ sFJMKb+79MAZIrCjgplDdCda8GA7IwNPi0177W8UabsDqgB5++qC2ME5GlmlKZBWCt 4ZmPJFej36azxQctCBZuHO3OGBxdTKnJehAx7dBwX3Wu+wFoLvVm56zmrtXIe7iObm 88JpRliRgktbg== From: Mike Rapoport To: Andrew Morton Cc: Catalin Marinas , Klara Modin , Mike Rapoport , Will Deacon , linux-arm-kernel@lists.infradead.org, linux-mm@kvack.org, linux-kernel@vger.kernel.org Subject: [PATCH] arm64: patching: fix handling of execmem addresses Date: Wed, 22 May 2024 00:38:13 +0300 Message-ID: <20240521213813.703309-1-rppt@kernel.org> X-Mailer: git-send-email 2.43.0 MIME-Version: 1.0 X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20240521_143830_176361_D6BBB712 X-CRM114-Status: GOOD ( 12.47 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org From: Will Deacon Klara Modin reported warnings for a kernel configured with BPF_JIT but without MODULES: [ 44.131296] Trying to vfree() bad address (000000004a17c299) [ 44.138024] WARNING: CPU: 1 PID: 193 at mm/vmalloc.c:3189 remove_vm_area (mm/vmalloc.c:3189 (discriminator 1)) [ 44.146675] CPU: 1 PID: 193 Comm: kworker/1:2 Tainted: G D W 6.9.0-01786-g2c9e5d4a0082 #25 [ 44.158229] Hardware name: Raspberry Pi 3 Model B (DT) [ 44.164433] Workqueue: events bpf_prog_free_deferred [ 44.170492] pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 44.178601] pc : remove_vm_area (mm/vmalloc.c:3189 (discriminator 1)) [ 44.183705] lr : remove_vm_area (mm/vmalloc.c:3189 (discriminator 1)) [ 44.188772] sp : ffff800082a13c70 [ 44.193112] x29: ffff800082a13c70 x28: 0000000000000000 x27: 0000000000000000 [ 44.201384] x26: 0000000000000000 x25: ffff00003a44efa0 x24: 00000000d4202000 [ 44.209658] x23: ffff800081223dd0 x22: ffff00003a198a40 x21: ffff8000814dd880 [ 44.217924] x20: 00000000d4202000 x19: ffff8000814dd880 x18: 0000000000000006 [ 44.226206] x17: 0000000000000000 x16: 0000000000000020 x15: 0000000000000002 [ 44.234460] x14: ffff8000811a6370 x13: 0000000020000000 x12: 0000000000000000 [ 44.242710] x11: ffff8000811a6370 x10: 0000000000000144 x9 : ffff8000811fe370 [ 44.250959] x8 : 0000000000017fe8 x7 : 00000000fffff000 x6 : ffff8000811fe370 [ 44.259206] x5 : 0000000000000000 x4 : 0000000000000000 x3 : 0000000000000000 [ 44.267457] x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff000002203240 [ 44.275703] Call trace: [ 44.279158] remove_vm_area (mm/vmalloc.c:3189 (discriminator 1)) [ 44.283858] vfree (mm/vmalloc.c:3322) [ 44.287835] execmem_free (mm/execmem.c:70) [ 44.292347] bpf_jit_free_exec+0x10/0x1c [ 44.297283] bpf_prog_pack_free (kernel/bpf/core.c:1006) [ 44.302457] bpf_jit_binary_pack_free (kernel/bpf/core.c:1195) [ 44.307951] bpf_jit_free (include/linux/filter.h:1083 arch/arm64/net/bpf_jit_comp.c:2474) [ 44.312342] bpf_prog_free_deferred (kernel/bpf/core.c:2785) [ 44.317785] process_one_work (kernel/workqueue.c:3273) [ 44.322684] worker_thread (kernel/workqueue.c:3342 (discriminator 2) kernel/workqueue.c:3429 (discriminator 2)) [ 44.327292] kthread (kernel/kthread.c:388) [ 44.331342] ret_from_fork (arch/arm64/kernel/entry.S:861) The problem is because bpf_arch_text_copy() silently fails to write to the read-only area as a result of patch_map() faulting and the resulting -EFAULT being chucked away. Update patch_map() to use CONFIG_EXECMEM instead of CONFIG_STRICT_MODULE_RWX to check for vmalloc addresses. Fixes: 2c9e5d4a0082 ("bpf: remove CONFIG_BPF_JIT dependency on CONFIG_MODULES of") Reported-by: Klara Modin Closes: https://lore.kernel.org/all/7983fbbf-0127-457c-9394-8d6e4299c685@gmail.com Signed-off-by: Will Deacon Tested-by: Klara Modin Signed-off-by: Mike Rapoport (IBM) --- Andrew, if you can pick this up before -rc1 it won't need to wait for arm64 tree rebase arch/arm64/kernel/patching.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) base-commit: 8f6a15f095a63a83b096d9b29aaff4f0fbe6f6e6 diff --git a/arch/arm64/kernel/patching.c b/arch/arm64/kernel/patching.c index 255534930368..945df74005c7 100644 --- a/arch/arm64/kernel/patching.c +++ b/arch/arm64/kernel/patching.c @@ -36,7 +36,7 @@ static void __kprobes *patch_map(void *addr, int fixmap) if (image) page = phys_to_page(__pa_symbol(addr)); - else if (IS_ENABLED(CONFIG_STRICT_MODULE_RWX)) + else if (IS_ENABLED(CONFIG_EXECMEM)) page = vmalloc_to_page(addr); else return addr;