arm64: entry: Move the trampoline data page before the text page

commit c091fb6ae059cda563b2a4d93fdbc548ef34e1d6 upstream.

The trampoline code has a data page that holds the address of the vectors,
which is unmapped when running in user-space. This ensures that with
CONFIG_RANDOMIZE_BASE, the randomised address of the kernel can't be
discovered until after the kernel has been mapped.

If the trampoline text page is extended to include multiple sets of
vectors, it will be larger than a single page, making it tricky to
find the data page without knowing the size of the trampoline text
pages, which will vary with PAGE_SIZE.

Move the data page to appear before the text page. This allows the
data page to be found without knowing the size of the trampoline text
pages. 'tramp_vectors' is used to refer to the beginning of the
.entry.tramp.text section, do that explicitly.

Reviewed-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
Reviewed-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: James Morse <james.morse@arm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
CVE-2022-23960
Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@canonical.com>

diff --git a/arch/arm64/include/asm/fixmap.h b/arch/arm64/include/asm/fixmap.h
index 4335800201c97ad1d22bc61ec2a3b12f498f2377..0aabc0253b18f88e486ed179ff03f336a0b4b177 100644 (file)
--- a/arch/arm64/include/asm/fixmap.h
+++ b/arch/arm64/include/asm/fixmap.h
@@ -62,8 +62,8 @@ enum fixed_addresses {
 #endif /* CONFIG_ACPI_APEI_GHES */
 
 #ifdef CONFIG_UNMAP_KERNEL_AT_EL0
-       FIX_ENTRY_TRAMP_DATA,
        FIX_ENTRY_TRAMP_TEXT,
+       FIX_ENTRY_TRAMP_DATA,
 #define TRAMP_VALIAS           (__fix_to_virt(FIX_ENTRY_TRAMP_TEXT))
 #endif /* CONFIG_UNMAP_KERNEL_AT_EL0 */
        __end_of_permanent_fixed_addresses,

diff --git a/arch/arm64/kernel/entry.S b/arch/arm64/kernel/entry.S
index 702cad75a5d57767f1239592c8756adfc5c917ec..67090569815b3676b5c6afddcdaf52b095fc91f2 100644 (file)
--- a/arch/arm64/kernel/entry.S
+++ b/arch/arm64/kernel/entry.S
@@ -644,6 +644,11 @@ alternative_else_nop_endif
         */
        .endm
 
+       .macro tramp_data_page  dst
+       adr     \dst, .entry.tramp.text
+       sub     \dst, \dst, PAGE_SIZE
+       .endm
+
        .macro tramp_ventry, regsize = 64
        .align  7
 1:
@@ -660,7 +665,7 @@ alternative_else_nop_endif
 2:
        tramp_map_kernel        x30
 #ifdef CONFIG_RANDOMIZE_BASE
-       adr     x30, tramp_vectors + PAGE_SIZE
+       tramp_data_page         x30
 alternative_insn isb, nop, ARM64_WORKAROUND_QCOM_FALKOR_E1003
        ldr     x30, [x30]
 #else
@@ -851,7 +856,7 @@ SYM_CODE_START(__sdei_asm_entry_trampoline)
 1:     str     x4, [x1, #(SDEI_EVENT_INTREGS + S_SDEI_TTBR1)]
 
 #ifdef CONFIG_RANDOMIZE_BASE
-       adr     x4, tramp_vectors + PAGE_SIZE
+       tramp_data_page         x4
        add     x4, x4, #:lo12:__sdei_asm_trampoline_next_handler
        ldr     x4, [x4]
 #else