CVE: CVE-2025-21869
Published: 2025-03-27
Description: In the Linux kernel, the following vulnerability has been resolved:

powerpc/code-patching: Disable KASAN report during patching via temporary mm

Erhard reports the following KASAN hit on Talos II (power9) with kernel 6.13:

[   12.028126] ==================================================================
[   12.028198] BUG: KASAN: user-memory-access in copy_to_kernel_nofault+0x8c/0x1a0
[   12.028260] Write of size 8 at addr 0000187e458f2000 by task systemd/1

[   12.028346] CPU: 87 UID: 0 PID: 1 Comm: systemd Tainted: G                T  6.13.0-P9-dirty #3
[   12.028408] Tainted: [T]=RANDSTRUCT
[   12.028446] Hardware name: T2P9D01 REV 1.01 POWER9 0x4e1202 opal:skiboot-bc106a0 PowerNV
[   12.028500] Call Trace:
[   12.028536] [c000000008dbf3b0] [c[PII_REDACTED]56a48] dump_stack_lvl+0xbc/0x110 (unreliable)
[   12.028609] [c000000008dbf3f0] [c[PII_REDACTED]e2fc8] print_report+0x6b0/0x708
[   12.028666] [c000000008dbf4e0] [c[PII_REDACTED]e2454] kasan_report+0x164/0x300
[   12.028725] [c000000008dbf600] [c[PII_REDACTED]e54d4] kasan_check_range+0x314/0x370
[   12.028784] [c000000008dbf640] [c[PII_REDACTED]e6310] __kasan_check_write+0x20/0x40
[   12.028842] [c000000008dbf660] [c[PII_REDACTED]78e8c] copy_to_kernel_nofault+0x8c/0x1a0
[   12.028902] [c000000008dbf6a0] [c[PII_REDACTED]acfe4] __patch_instructions+0x194/0x210
[   12.028965] [c000000008dbf6e0] [c[PII_REDACTED]ade80] patch_instructions+0x150/0x590
[   12.029026] [c000000008dbf7c0] [c[PII_REDACTED]159bc] bpf_arch_text_copy+0x6c/0xe0
[   12.029085] [c000000008dbf800] [c[PII_REDACTED]24250] bpf_jit_binary_pack_finalize+0x40/0xc0
[   12.029147] [c000000008dbf830] [c[PII_REDACTED]15dec] bpf_int_jit_compile+0x3bc/0x930
[   12.029206] [c000000008dbf990] [c[PII_REDACTED]23720] bpf_prog_select_runtime+0x1f0/0x280
[   12.029266] [c000000008dbfa00] [c[PII_REDACTED]34b18] bpf_prog_load+0xbb8/0x1370
[   12.029324] [c000000008dbfb70] [c[PII_REDACTED]36ebc] __sys_bpf+0x5ac/0x2e00
[   12.029379] [c000000008dbfd00] [c[PII_REDACTED]3a228] sys_bpf+0x28/0x40
[   12.029435] [c000000008dbfd20] [c[PII_REDACTED]38eb4] system_call_exception+0x334/0x610
[   12.029497] [c000000008dbfe50] [c[PII_REDACTED]0c270] system_call_vectored_common+0xf0/0x280
[   12.029561] --- interrupt: 3000 at 0x3fff82f5cfa8
[   12.029608] NIP:  00003fff82f5cfa8 LR: 00003fff82f5cfa8 CTR: [PII_REDACTED]
[   12.029660] REGS: c000000008dbfe80 TRAP: 3000   Tainted: G                T   (6.13.0-P9-dirty)
[   12.029735] MSR: [PII_REDACTED]80f032 <SF,HV,VEC,VSX,EE,PR,FP,ME,IR,DR,RI>  CR: 42004848  XER: 00000000
[   12.029855] IRQMASK: 0
               GPR00: [PII_REDACTED] 00003fffdcf789a0 00003fff83067100 [PII_REDACTED]
               GPR04: 00003fffdcf78a98 [PII_REDACTED] [PII_REDACTED] [PII_REDACTED]
               GPR08: [PII_REDACTED] [PII_REDACTED] [PII_REDACTED] [PII_REDACTED]
               GPR12: [PII_REDACTED] 00003fff836ff7e0 c[PII_REDACTED]10678 [PII_REDACTED]
               GPR16: [PII_REDACTED] [PII_REDACTED] 00003fffdcf78f28 00003fffdcf78f90
               GPR20: [PII_REDACTED] [PII_REDACTED] [PII_REDACTED] 00003fffdcf78f80
               GPR24: 00003fffdcf78f70 00003fffdcf78d10 00003fff835c7239 00003fffdcf78bd8
               GPR28: 00003fffdcf78a98 [PII_REDACTED] [PII_REDACTED] 000000011f547580
[   12.030316] NIP [00003fff82f5cfa8] 0x3fff82f5cfa8
[   12.030361] LR [00003fff82f5cfa8] 0x3fff82f5cfa8
[   12.030405] --- interrupt: 3000
[   12.030444] ==================================================================

Commit c28c15b6d28a ("powerpc/code-patching: Use temporary mm for
Radix MMU") is inspired from x86 but unlike x86 is doesn't disable
KASAN reports during patching. This wasn't a problem at the begining
because __patch_mem() is not instrumented.

Commit 465cabc97b42 ("powerpc/code-patching: introduce
patch_instructions()") use copy_to_kernel_nofault() to copy several
instructions at once. But when using temporary mm the destination is
not regular kernel memory but a kind of kernel-like memory located
in user address space. 
---truncated---
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://git.kernel.org/stable/c/5980d4456dd66d1b6505d5ec15048bd87e8775e0; https://git.kernel.org/stable/c/dc9c5166c3cb044f8a001e397195242fd6796eee; https://git.kernel.org/stable/c/ea291447a4031f3dac5c23d55bc83fe833820d84