From nobody Tue Dec 16 13:48:41 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id A2B75CDB46E for ; Thu, 12 Oct 2023 18:36:58 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1441869AbjJLSg6 (ORCPT ); Thu, 12 Oct 2023 14:36:58 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:50800 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1379714AbjJLSgu (ORCPT ); Thu, 12 Oct 2023 14:36:50 -0400 Received: from galois.linutronix.de (Galois.linutronix.de [IPv6:2a0a:51c0:0:12e:550::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id E2A53E8; Thu, 12 Oct 2023 11:36:48 -0700 (PDT) Date: Thu, 12 Oct 2023 18:36:46 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linutronix.de; s=2020; t=1697135807; h=from:from:sender:sender:reply-to:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=Pw7es2hh7qvHHY9PDbdAV77XkoPYW54NCoEKygSaPGA=; b=obEgyN14FSYqYZ4k/o0BZYWyv892Xc8mH1ru52uWXOufIYANZm4Khh9yQ/PAwXKg1LW99v JQHhxR74Um9OVmAzGQ7/S9ejMMjKb9/OTotrMYynzQs+DRx6jqwQGJoWmh3S3/klWAKbBI usf9u2ZS7sAqr1+phY0ngH1HcE4kllUd8lFybyXcnnIwztvhEbvFOKg/68oGc1p5X9ByJR InHWHJv7WS+w5tZuqj5e4BK+LZM8XDrgch1oiWIvYGJZGemMZklNQwr3sp6klKSVZB6Uhy nPBd0h0QfLfMyxLU59Jn4dILqZlnpw1dnUoWsaEKMWxtoeIexGPcxjm6UmgI3g== DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=linutronix.de; s=2020e; t=1697135807; h=from:from:sender:sender:reply-to:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=Pw7es2hh7qvHHY9PDbdAV77XkoPYW54NCoEKygSaPGA=; b=BK9Fm3pbkZP3Z70AdYJks9gghRogBj730FV1St1XIfoS3wM5MmF9E0CxWFujwqnltexNdV CVxUzeY+odCHAyAA== From: "tip-bot2 for Kirill A. Shutemov" Sender: tip-bot2@linutronix.de Reply-to: linux-kernel@vger.kernel.org To: linux-tip-commits@vger.kernel.org Subject: [tip: x86/urgent] x86/alternatives: Disable KASAN in apply_alternatives() Cc: Fei Yang , "Kirill A. Shutemov" , Ingo Molnar , "Peter Zijlstra (Intel)" , Linus Torvalds , stable@vger.kernel.org, x86@kernel.org, linux-kernel@vger.kernel.org In-Reply-To: <20231012100424.1456-1-kirill.shutemov@linux.intel.com> References: <20231012100424.1456-1-kirill.shutemov@linux.intel.com> MIME-Version: 1.0 Message-ID: <169713580687.3135.7724105544670888547.tip-bot2@tip-bot2> Robot-ID: Robot-Unsubscribe: Contact to get blacklisted from these emails Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org The following commit has been merged into the x86/urgent branch of tip: Commit-ID: d35652a5fc9944784f6f50a5c979518ff8dacf61 Gitweb: https://git.kernel.org/tip/d35652a5fc9944784f6f50a5c979518ff= 8dacf61 Author: Kirill A. Shutemov AuthorDate: Thu, 12 Oct 2023 13:04:24 +03:00 Committer: Ingo Molnar CommitterDate: Thu, 12 Oct 2023 20:27:16 +02:00 x86/alternatives: Disable KASAN in apply_alternatives() Fei has reported that KASAN triggers during apply_alternatives() on a 5-level paging machine: BUG: KASAN: out-of-bounds in rcu_is_watching() Read of size 4 at addr ff110003ee6419a0 by task swapper/0/0 ... __asan_load4() rcu_is_watching() trace_hardirqs_on() text_poke_early() apply_alternatives() ... On machines with 5-level paging, cpu_feature_enabled(X86_FEATURE_LA57) gets patched. It includes KASAN code, where KASAN_SHADOW_START depends on __VIRTUAL_MASK_SHIFT, which is defined with cpu_feature_enabled(). KASAN gets confused when apply_alternatives() patches the KASAN_SHADOW_START users. A test patch that makes KASAN_SHADOW_START static, by replacing __VIRTUAL_MASK_SHIFT with 56, works around the issue. Fix it for real by disabling KASAN while the kernel is patching alternative= s. [ mingo: updated the changelog ] Fixes: 6657fca06e3f ("x86/mm: Allow to boot without LA57 if CONFIG_X86_5LEV= EL=3Dy") Reported-by: Fei Yang Signed-off-by: Kirill A. Shutemov Signed-off-by: Ingo Molnar Acked-by: Peter Zijlstra (Intel) Cc: Linus Torvalds Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20231012100424.1456-1-kirill.shutemov@linux= .intel.com --- arch/x86/kernel/alternative.c | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/arch/x86/kernel/alternative.c b/arch/x86/kernel/alternative.c index 517ee01..73be393 100644 --- a/arch/x86/kernel/alternative.c +++ b/arch/x86/kernel/alternative.c @@ -403,6 +403,17 @@ void __init_or_module noinline apply_alternatives(stru= ct alt_instr *start, u8 insn_buff[MAX_PATCH_LEN]; =20 DPRINTK(ALT, "alt table %px, -> %px", start, end); + + /* + * In the case CONFIG_X86_5LEVEL=3Dy, KASAN_SHADOW_START is defined using + * cpu_feature_enabled(X86_FEATURE_LA57) and is therefore patched here. + * During the process, KASAN becomes confused seeing partial LA57 + * conversion and triggers a false-positive out-of-bound report. + * + * Disable KASAN until the patching is complete. + */ + kasan_disable_current(); + /* * The scan order should be from start to end. A later scanned * alternative code can overwrite previously scanned alternative code. @@ -452,6 +463,8 @@ void __init_or_module noinline apply_alternatives(struc= t alt_instr *start, =20 text_poke_early(instr, insn_buff, insn_buff_sz); } + + kasan_enable_current(); } =20 static inline bool is_jcc32(struct insn *insn)