arm64: kexec: load from kimage prior to clobbering
authorMark Rutland <mark.rutland@arm.com>
Mon, 16 May 2022 16:07:35 +0000 (17:07 +0100)
committerWill Deacon <will@kernel.org>
Tue, 17 May 2022 13:25:35 +0000 (14:25 +0100)
commiteb3d8ea3e1f03f4b0b72d8f5ed9eb7c3165862e8
tree3ab5a2631364c0da3c3757414a4f0d01179c9fb4
parent19bef63f951e47dd4ba54810e6f7c7ff9344a3ef
arm64: kexec: load from kimage prior to clobbering

In arm64_relocate_new_kernel() we load some fields out of the kimage
structure after relocation has occurred. As the kimage structure isn't
allocated to be relocation-safe, it may be clobbered during relocation,
and we may load junk values out of the structure.

Due to this, kexec may fail when the kimage allocation happens to fall
within a PA range that an object will be relocated to. This has been
observed to occur for regular kexec on a QEMU TCG 'virt' machine with
2GiB of RAM, where the PA range of the new kernel image overlaps the
kimage structure.

Avoid this by ensuring we load all values from the kimage structure
prior to relocation.

I've tested this atop v5.16 and v5.18-rc6.

Fixes: 878fdbd70486 ("arm64: kexec: pass kimage as the only argument to relocation function")
Signed-off-by: Mark Rutland <mark.rutland@arm.com>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: James Morse <james.morse@arm.com>
Cc: Pasha Tatashin <pasha.tatashin@soleen.com>
Cc: Will Deacon <will@kernel.org>
Reviewed-by: Pasha Tatashin <pasha.tatashin@soleen.com>
Link: https://lore.kernel.org/r/20220516160735.731404-1-mark.rutland@arm.com
Signed-off-by: Will Deacon <will@kernel.org>
arch/arm64/kernel/relocate_kernel.S