title: x86/alternatives: Disable KASAN in apply_alternatives()
description: In the Linux kernel, the following vulnerability has been resolved:
x86/alternatives: Disable KASAN in apply_alternatives()
Fei has reported that KASAN triggers during apply_alternatives() on
a 5-level paging machine:
BUG: KASAN: out-of-bounds in rcu_is_watching()
Read of size 4 at addr ff110003ee6419a0 by task swapper/0/0
...
__asan_load4()
rcu_is_watching()
trace_hardirqs_on()
text_poke_early()
apply_alternatives()
...
On machines with 5-level paging, cpu_feature_enabled(X86_FEATURE_LA57)
gets patched. It includes KASAN code, where KASAN_SHADOW_START depends on
__VIRTUAL_MASK_SHIFT, which is defined with cpu_feature_enabled().
KASAN gets confused when apply_alternatives() patches the
KASAN_SHADOW_START users. A test patch that makes KASAN_SHADOW_START
static, by replacing __VIRTUAL_MASK_SHIFT with 56, works around the issue.
Fix it for real by disabling KASAN while the kernel is patching alternatives.
[ mingo: updated the changelog ]
affected:
{
product: Linux
vendor: Linux
defaultStatus: unaffected
repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
versions:
version: 6657fca06e3f, lessThan: 3719d3c36aa8, status: affected, versionType: git
version: 6657fca06e3f, lessThan: 3770c38cd6a6, status: affected, versionType: git
version: 6657fca06e3f, lessThan: 6788b10620ca, status: affected, versionType: git
version: 6657fca06e3f, lessThan: ecba5afe86f3, status: affected, versionType: git
version: 6657fca06e3f, lessThan: 5b784489c815, status: affected, versionType: git
version: 6657fca06e3f, lessThan: cd287cc208df, status: affected, versionType: git
version: 6657fca06e3f, lessThan: d35652a5fc99, status: affected, versionType: git
}
{
product: Linux
vendor: Linux
defaultStatus: affected
repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
versions:
version: 4.17, status: affected
version: 0, lessThan: 4.17, status: unaffected, versionType: custom
version: 4.19.297, lessThanOrEqual: 4.19.*, status: unaffected, versionType: custom
version: 5.4.270, lessThanOrEqual: 5.4.*, status: unaffected, versionType: custom
version: 5.10.199, lessThanOrEqual: 5.10.*, status: unaffected, versionType: custom
version: 5.15.136, lessThanOrEqual: 5.15.*, status: unaffected, versionType: custom
version: 6.1.59, lessThanOrEqual: 6.1.*, status: unaffected, versionType: custom
version: 6.5.8, lessThanOrEqual: 6.5.*, status: unaffected, versionType: custom
version: 6.6, lessThanOrEqual: *, status: unaffected, versionType: original_commit_for_fix
}
