CVE: CVE-2021-47034
Published: 2024-02-28
Description: In the Linux kernel, the following vulnerability has been resolved:

powerpc/64s: Fix pte update for kernel memory on radix

When adding a PTE a ptesync is needed to order the update of the PTE
with subsequent accesses otherwise a spurious fault may be raised.

radix__set_pte_at() does not do this for performance gains. For
non-kernel memory this is not an issue as any faults of this kind are
corrected by the page fault handler. For kernel memory these faults
are not handled. The current solution is that there is a ptesync in
flush_cache_vmap() which should be called when mapping from the
vmalloc region.

However, map_kernel_page() does not call flush_cache_vmap(). This is
troublesome in particular for code patching with Strict RWX on radix.
In do_patch_instruction() the page frame that contains the instruction
to be patched is mapped and then immediately patched. With no ordering
or synchronization between setting up the PTE and writing to the page
it is possible for faults.

As the code patching is done using __put_user_asm_goto() the resulting
fault is obscured - but using a normal store instead it can be seen:

  BUG: Unable to handle kernel data access on write at 0xc008000008f24a3c
  Faulting instruction address: 0xc[PII_REDACTED]8bd74
  Oops: Kernel access of bad area, sig: 11 [#1]
  LE PAGE_SIZE=64K MMU=Radix SMP NR_CPUS=2048 NUMA PowerNV
  Modules linked in: nop_module(PO+) [last unloaded: nop_module]
  CPU: 4 PID: 757 Comm: sh Tainted: P           O      5.10.0-rc5-01361-ge3c1b78c8440-dirty #43
  NIP:  c[PII_REDACTED]8bd74 LR: c[PII_REDACTED]8bd50 CTR: c[PII_REDACTED]25810
  REGS: c000000016f634a0 TRAP: 0300   Tainted: P           O       (5.10.0-rc5-01361-ge3c1b78c8440-dirty)
  MSR:  [PII_REDACTED] <SF,HV,EE,ME,IR,DR,RI,LE>  CR: 44002884  XER: 00000000
  CFAR: c[PII_REDACTED]7c68c DAR: c008000008f24a3c DSISR: 42000000 IRQMASK: 1

This results in the kind of issue reported here:
  https://lore.kernel.org/linuxppc-dev/15AC5B0E-A221-4B8C-9039-FA96B8EF7C88@lca.pw/

Chris Riedl suggested a reliable way to reproduce the issue:
  $ mount -t debugfs none /sys/kernel/debug
  $ (while true; do echo function > /sys/kernel/debug/tracing/current_tracer ; echo nop > /sys/kernel/debug/tracing/current_tracer ; done) &

Turning ftrace on and off does a large amount of code patching which
in usually less then 5min will crash giving a trace like:

   ftrace-powerpc: (____ptrval____): replaced (4b473b11) != old (60000000)
   ------------[ ftrace bug ]------------
   ftrace failed to modify
   [<c000000000bf8e5c>] napi_busy_loop+0xc/0x390
    actual:   11:3b:47:4b
   Setting ftrace call site to call ftrace function
   ftrace record flags: 80000001
    (1)
    expected tramp: c[PII_REDACTED]6c96c
   ------------[ cut here ]------------
   WARNING: CPU: 4 PID: 809 at kernel/trace/ftrace.c:2065 ftrace_bug+0x28c/0x2e8
   Modules linked in: nop_module(PO-) [last unloaded: nop_module]
   CPU: 4 PID: 809 Comm: sh Tainted: P           O      5.10.0-rc5-01360-gf878ccaf250a #1
   NIP:  c[PII_REDACTED]4f334 LR: c[PII_REDACTED]4f330 CTR: c[PII_REDACTED]a5af0
   REGS: c000000004c8b760 TRAP: 0700   Tainted: P           O       (5.10.0-rc5-01360-gf878ccaf250a)
   MSR: [PII_REDACTED]82b033 <SF,HV,VEC,VSX,EE,FP,ME,IR,DR,RI,LE>  CR: 28008848  XER: 20040000
   CFAR: c[PII_REDACTED]a9c98 IRQMASK: 0
   GPR00: c[PII_REDACTED]4f330 c000000004c8b9f0 c[PII_REDACTED]70600 [PII_REDACTED]
   GPR04: 00000000ffff7fff c000000004c8b6d0 [PII_REDACTED] c0000007fe9bcdd8
   GPR08: [PII_REDACTED] ffffffffffffffd8 [PII_REDACTED] c[PII_REDACTED]13118
   GPR12: [PII_REDACTED] c0000007fffdca00 [PII_REDACTED] [PII_REDACTED]
   GPR16:[PII_REDACTED]ec37c5 [PII_REDACTED] [PII_REDACTED] [PII_REDACTED]
   GPR20: c000000004c8bc90 c[PII_REDACTED]a2d20 c000000004c8bcd0 c[PII_REDACTED]12fe8
   GPR24: [PII_REDACTED] [PII_REDACTED] [PII_REDACTED] [PII_REDACTED]
   GPR28: c000000000ff1b68 c000000000bf8e5c c[PII_REDACTED]2f700 c000000000fbb9b0
   NIP ftrace_bug+0x28c/0x2e8
   LR  ftrace_bug+0x288/0x2e8
   Call T
---truncated---
CVSS Score: 4.4 (MEDIUM)
References: https://git.kernel.org/stable/c/01ac203e2119d[PII_REDACTED]ddea309fb676f955f; https://git.kernel.org/stable/c/73f9dccb29e4f82574bec2765c0090cdb0404301; https://git.kernel.org/stable/c/84c0762633f2a7ac8399e6b97d3b9bb8e6e1d50f