Re: [PATCH v2 1/2] arm64: kexec: use a typed entry to fix kCFI oops

[sashiko-bot@kernel.org]

> An arm64 Linux kernel built with CONFIG_CFI=y oopses after "Bye!" on
> every kexec that relocates the image. Crash images load in place and are
> not affected. The oops reproduces under QEMU:
> 
>  Unable to handle kernel paging request at virtual address 00000000544bfffc
>  pc : machine_kexec+0x104/0x274
>  Code: d5182008 d5033fdf aa1303e0 f9418a68 (b85fc110)
> 
> b85fc110 is "ldur w16, [x8, #-4]", the kCFI check's load of the type
> hash in front of the callee. Commit efc2d0f20a9d ("arm64: kexec: keep
> MMU enabled during kexec relocation") made machine_kexec() call the
> control page's copy of arm64_relocate_new_kernel() indirectly, while
> TTBR0 maps only that page. The copy starts at the page's first byte, so
> the load faults. SYM_CODE_START() also gives the routine no hash.
> 
> [ ... ]
> Fixes: efc2d0f20a9d ("arm64: kexec: keep MMU enabled during kexec relocation")
> Cc: stable@vger.kernel.org
> Suggested-by: Kees Cook <kees@kernel.org>
> Link: https://lore.kernel.org/linux-arm-kernel/202609241804.BB23BF10@keescook/
> Signed-off-by: Ben Cressey <ben@cressey.dev>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261111-arm64-kexec-nocfi-v2-0-ddf0c4aa326f@cressey.dev?part=1