linux-yocto/arch
Kees Cook 6a0f13941c arm64: mm: Fix CFI failure due to kpti_ng_pgd_alloc function signature
commit ceca927c86e6f72f72d45487a34368bc9509431d upstream.

Seen during KPTI initialization:

  CFI failure at create_kpti_ng_temp_pgd+0x124/0xce8 (target: kpti_ng_pgd_alloc+0x0/0x14; expected type: 0xd61b88b6)

The call site is alloc_init_pud() at arch/arm64/mm/mmu.c:

  pud_phys = pgtable_alloc(TABLE_PUD);

alloc_init_pud() has the prototype:

  static void alloc_init_pud(p4d_t *p4dp, unsigned long addr, unsigned long end,
                             phys_addr_t phys, pgprot_t prot,
                             phys_addr_t (*pgtable_alloc)(enum pgtable_type),
                             int flags)

where the pgtable_alloc() prototype is declared.

The target (kpti_ng_pgd_alloc) is used in arch/arm64/kernel/cpufeature.c:

  create_kpti_ng_temp_pgd(kpti_ng_temp_pgd, __pa(alloc), KPTI_NG_TEMP_VA,
                          PAGE_SIZE, PAGE_KERNEL, kpti_ng_pgd_alloc, 0);

which is an alias for __create_pgd_mapping_locked() with prototype:

  extern __alias(__create_pgd_mapping_locked)
  void create_kpti_ng_temp_pgd(pgd_t *pgdir, phys_addr_t phys,
                               unsigned long virt,
                               phys_addr_t size, pgprot_t prot,
                               phys_addr_t (*pgtable_alloc)(enum pgtable_type),
                               int flags);

__create_pgd_mapping_locked() passes the function pointer down:

  __create_pgd_mapping_locked() -> alloc_init_p4d() -> alloc_init_pud()

But the target function (kpti_ng_pgd_alloc) has the wrong signature:

  static phys_addr_t __init kpti_ng_pgd_alloc(int shift);

The "int" should be "enum pgtable_type".

To make "enum pgtable_type" available to cpufeature.c, move
enum pgtable_type definition from arch/arm64/mm/mmu.c to
arch/arm64/include/asm/mmu.h.

Adjust kpti_ng_pgd_alloc to use "enum pgtable_type" instead of "int".
The function behavior remains identical (parameter is unused).

Fixes: c64f46ee13 ("arm64: mm: use enum to identify pgtable level instead of *_SHIFT")
Cc: <stable@vger.kernel.org> # 6.16.x
Signed-off-by: Kees Cook <kees@kernel.org>
Acked-by: Ard Biesheuvel <ardb@kernel.org>
Link: https://lore.kernel.org/r/20250829190721.it.373-kees@kernel.org
Reviewed-by: Ryan Roberts <ryan.roberts@arm.com>
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-09-04 16:55:46 +02:00
..
alpha mm: pgtable: fix pte_swp_exclusive 2025-06-11 14:52:08 -07:00
arc ARC fixes for 6.16 2025-06-12 08:17:56 -07:00
arm lib/crypto: arm/poly1305: Fix register corruption in no-SIMD contexts 2025-08-28 16:34:13 +02:00
arm64 arm64: mm: Fix CFI failure due to kpti_ng_pgd_alloc function signature 2025-09-04 16:55:46 +02:00
csky mm: pgtable: fix pte_swp_exclusive 2025-06-11 14:52:08 -07:00
hexagon mm: pgtable: fix pte_swp_exclusive 2025-06-11 14:52:08 -07:00
loongarch LoongArch: KVM: Use kvm_get_vcpu_by_id() instead of kvm_get_vcpu() 2025-08-28 16:34:49 +02:00
m68k m68k: Fix lost column on framebuffer debug console 2025-08-28 16:34:12 +02:00
microblaze mm: pgtable: fix pte_swp_exclusive 2025-06-11 14:52:08 -07:00
mips mips: lantiq: xway: sysctrl: rename the etop node 2025-09-04 16:55:29 +02:00
nios2 mm: pgtable: fix pte_swp_exclusive 2025-06-11 14:52:08 -07:00
openrisc mm: pgtable: fix pte_swp_exclusive 2025-06-11 14:52:08 -07:00
parisc parisc: Update comments in make_insert_tlb 2025-08-28 16:34:27 +02:00
powerpc powerpc/kvm: Fix ifdef to remove build warning 2025-09-04 16:55:33 +02:00
riscv RISC-V: KVM: fix stack overrun when loading vlenb 2025-09-04 16:55:44 +02:00
s390 s390/hypfs: Enable limited access during lockdown 2025-08-28 16:34:51 +02:00
sh sh: Do not use hyphen in exported variable name 2025-08-15 16:39:12 +02:00
sparc mm: pgtable: fix pte_swp_exclusive 2025-06-11 14:52:08 -07:00
um um: Re-evaluate thread flags repeatedly 2025-08-20 18:41:09 +02:00
x86 x86/cpu/topology: Use initial APIC ID from XTOPOLOGY leaf on AMD/HYGON 2025-09-04 16:55:44 +02:00
xtensa mm: pgtable: fix pte_swp_exclusive 2025-06-11 14:52:08 -07:00
.gitignore
Kconfig fs/resctrl: Add boiler plate for external resctrl code 2025-05-16 11:05:40 +02:00