Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752563AbdHPTIO (ORCPT ); Wed, 16 Aug 2017 15:08:14 -0400 Received: from mail-wr0-f177.google.com ([209.85.128.177]:35280 "EHLO mail-wr0-f177.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752528AbdHPTIN (ORCPT ); Wed, 16 Aug 2017 15:08:13 -0400 From: Alexander Potapenko To: tglx@linutronix.de, mingo@redhat.com, hpa@zytor.com Cc: x86@kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH] x86/boot/64: clang: use fixup_pointer() to access next_early_pgt Date: Wed, 16 Aug 2017 21:08:08 +0200 Message-Id: <20170816190808.131748-1-glider@google.com> X-Mailer: git-send-email 2.14.1.480.gb18f417b89-goog Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1773 Lines: 44 __startup_64() is normally using fixup_pointer() to access globals in a position-independent fashion. However |next_early_pgt| was accessed directly, which wasn't guaranteed to work. Luckily GCC was generating a R_X86_64_PC32 PC-relative relocation for |next_early_pgt|, but Clang emitted a R_X86_64_32S, which led to accessing invalid memory and rebooting the kernel. Cc: Kirill A. Shutemov Cc: Dmitry Vyukov Cc: Michael Davidson Fixes: c88d71508e36 ("x86/boot/64: Rewrite startup_64() in C") Signed-off-by: Alexander Potapenko --- arch/x86/kernel/head64.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/arch/x86/kernel/head64.c b/arch/x86/kernel/head64.c index 46c3c73e7f43..9ba79543d9ee 100644 --- a/arch/x86/kernel/head64.c +++ b/arch/x86/kernel/head64.c @@ -53,6 +53,7 @@ void __head __startup_64(unsigned long physaddr) pudval_t *pud; pmdval_t *pmd, pmd_entry; int i; + unsigned int *next_pgt_ptr; /* Is the address too large? */ if (physaddr >> MAX_PHYSMEM_BITS) @@ -91,9 +92,9 @@ void __head __startup_64(unsigned long physaddr) * creates a bunch of nonsense entries but that is fine -- * it avoids problems around wraparound. */ - - pud = fixup_pointer(early_dynamic_pgts[next_early_pgt++], physaddr); - pmd = fixup_pointer(early_dynamic_pgts[next_early_pgt++], physaddr); + next_pgt_ptr = fixup_pointer(&next_early_pgt, physaddr); + pud = fixup_pointer(early_dynamic_pgts[(*next_pgt_ptr)++], physaddr); + pmd = fixup_pointer(early_dynamic_pgts[(*next_pgt_ptr)++], physaddr); if (IS_ENABLED(CONFIG_X86_5LEVEL)) { p4d = fixup_pointer(early_dynamic_pgts[next_early_pgt++], physaddr); -- 2.14.1.480.gb18f417b89-goog