Re: [PATCH] ARC: fix CONFIG_HARDENED_USERCOPY

2021-06-10 Thread Kees Cook 
On Wed, Jun 09, 2021 at 03:12:11PM -0700, Vineet Gupta wrote:
> Currently enabling this triggers a warning
> 
> | usercopy: Kernel memory overwrite attempt detected to kernel text (offset 
> 155633, size 11)!
> | usercopy: BUG: failure at mm/usercopy.c:99/usercopy_abort()!
> |
> |gcc generated __builtin_trap
> |Path: /bin/busybox
> |CPU: 0 PID: 84 Comm: init Not tainted 5.4.22
> |
> |[ECR ]: 0x00090005 => gcc generated __builtin_trap
> |[EFA ]: 0x9024fcaa
> |[BLINK ]: usercopy_abort+0x8a/0x8c
> |[ERET ]: memfd_fcntl+0x0/0x470
> |[STAT32]: 0x80080802 : IE K
> |BTA: 0x901ba38c SP: 0xbe161ecc FP: 0xbf9fe950
> |LPS: 0x90677408 LPE: 0x9067740c LPC: 0x
> |r00: 0x003c r01: 0xbf0ed280 r02: 0x
> |r03: 0xbe15fa30 r04: 0x00d2803e r05: 0x
> |r06: 0x675d7000 r07: 0x r08: 0x675d9c00
> |r09: 0x r10: 0x035c r11: 0x61206572
> |r12: 0x9024fcaa r13: 0x000b r14: 0x000b
> |r15: 0x r16: 0x90169ffc r17: 0x90168000
> |r18: 0x r19: 0xbf092010 r20: 0x0001
> |r21: 0x0011 r22: 0x5ff1 r23: 0x90169ff1
> |r24: 0xbe196c00 r25: 0xbf0ed280
> |
> |Stack Trace:
> | memfd_fcntl+0x0/0x470
> | usercopy_abort+0x8a/0x8c
> | __check_object_size+0x10e/0x138
> | copy_strings+0x1f4/0x38c
> | __do_execve_file+0x352/0x848
> | EV_Trap+0xcc/0xd0

What was the root cause here? Was it that the init section gets freed
and reused for kmalloc?

> 
> Fixes: https://github.com/foss-for-synopsys-dwc-arc-processors/linux/issues/15
> Reported-by: Evgeniy Didin 
> Signed-off-by: Vineet Gupta 
> ---
>  arch/arc/kernel/vmlinux.lds.S | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/arch/arc/kernel/vmlinux.lds.S b/arch/arc/kernel/vmlinux.lds.S
> index 33ce59d91461..e2146a8da195 100644
> --- a/arch/arc/kernel/vmlinux.lds.S
> +++ b/arch/arc/kernel/vmlinux.lds.S
> @@ -57,7 +57,6 @@ SECTIONS
>   .init.ramfs : { INIT_RAM_FS }
>  
>   . = ALIGN(PAGE_SIZE);
> - _stext = .;
>  
>   HEAD_TEXT_SECTION
>   INIT_TEXT_SECTION(L1_CACHE_BYTES)
> @@ -83,6 +82,7 @@ SECTIONS
>  
>   .text : {
>   _text = .;
> + _stext = .;
>   TEXT_TEXT
>   SCHED_TEXT
>   CPUIDLE_TEXT
> -- 
> 2.25.1
> 

-- 
Kees Cook

___
linux-snps-arc mailing list
linux-snps-arc@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-snps-arc

[linux-next:master 8465/8758] arch/arc/kernel/signal.c:101:21: error: 'struct pt_regs' has no member named 'r30'; did you mean 'r10'?

2021-06-10 Thread kernel test robot 
Hi Vineet,

FYI, the error/warning still remains.

tree:   https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git 
master
head:   50a1180e6cf12462bbbf3f2ebc5b93094ed9abee
commit: 98ec2edf58c820ef953fbdfcf98d706aa804b822 [8465/8758] ARCv2: save ABI 
registers across signal handling
config: arc-randconfig-r001-20210610 (attached as .config)
compiler: arceb-elf-gcc (GCC) 9.3.0
reproduce (this is a W=1 build):
wget 
https://raw.githubusercontent.com/intel/lkp-tests/master/sbin/make.cross -O 
~/bin/make.cross
chmod +x ~/bin/make.cross
# 
https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/commit/?id=98ec2edf58c820ef953fbdfcf98d706aa804b822
git remote add linux-next 
https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git
git fetch --no-tags linux-next master
git checkout 98ec2edf58c820ef953fbdfcf98d706aa804b822
# save the attached .config to linux build tree
COMPILER_INSTALL_PATH=$HOME/0day COMPILER=gcc-9.3.0 make.cross ARCH=arc 

If you fix the issue, kindly add following tag as appropriate
Reported-by: kernel test robot 

All errors (new ones prefixed by >>):

   arch/arc/kernel/signal.c: In function 'stash_usr_regs':
>> arch/arc/kernel/signal.c:101:21: error: 'struct pt_regs' has no member named 
>> 'r30'; did you mean 'r10'?
 101 |   v2abi.r30 = regs->r30;
 | ^~~
 | r10
   arch/arc/kernel/signal.c: In function 'restore_usr_regs':
   arch/arc/kernel/signal.c:134:9: error: 'struct pt_regs' has no member named 
'r30'; did you mean 'r10'?
 134 |   regs->r30 = v2abi.r30;
 | ^~~
 | r10
   arch/arc/kernel/signal.c: At top level:
   arch/arc/kernel/signal.c:387:6: warning: no previous prototype for 
'do_signal' [-Wmissing-prototypes]
 387 | void do_signal(struct pt_regs *regs)
 |  ^
   arch/arc/kernel/signal.c:420:6: warning: no previous prototype for 
'do_notify_resume' [-Wmissing-prototypes]
 420 | void do_notify_resume(struct pt_regs *regs)
 |  ^~~~


vim +101 arch/arc/kernel/signal.c

63  
64  static int
65  stash_usr_regs(struct rt_sigframe __user *sf, struct pt_regs *regs,
66 sigset_t *set)
67  {
68  int err;
69  struct user_regs_struct uregs;
70  
71  uregs.scratch.bta   = regs->bta;
72  uregs.scratch.lp_start  = regs->lp_start;
73  uregs.scratch.lp_end= regs->lp_end;
74  uregs.scratch.lp_count  = regs->lp_count;
75  uregs.scratch.status32  = regs->status32;
76  uregs.scratch.ret   = regs->ret;
77  uregs.scratch.blink = regs->blink;
78  uregs.scratch.fp= regs->fp;
79  uregs.scratch.gp= regs->r26;
80  uregs.scratch.r12   = regs->r12;
81  uregs.scratch.r11   = regs->r11;
82  uregs.scratch.r10   = regs->r10;
83  uregs.scratch.r9= regs->r9;
84  uregs.scratch.r8= regs->r8;
85  uregs.scratch.r7= regs->r7;
86  uregs.scratch.r6= regs->r6;
87  uregs.scratch.r5= regs->r5;
88  uregs.scratch.r4= regs->r4;
89  uregs.scratch.r3= regs->r3;
90  uregs.scratch.r2= regs->r2;
91  uregs.scratch.r1= regs->r1;
92  uregs.scratch.r0= regs->r0;
93  uregs.scratch.sp= regs->sp;
94  
95  err = __copy_to_user(&(sf->uc.uc_mcontext.regs.scratch), 
&uregs.scratch,
96   sizeof(sf->uc.uc_mcontext.regs.scratch));
97  
98  if (is_isa_arcv2()) {
99  struct user_regs_arcv2 v2abi;
   100  
 > 101  v2abi.r30 = regs->r30;
   102  #ifdef CONFIG_ARC_HAS_ACCL_REGS
   103  v2abi.r58 = regs->r58;
   104  v2abi.r59 = regs->r59;
   105  #else
   106  v2abi.r58 = v2abi.r59 = 0;
   107  #endif
   108  err |= __copy_to_user(&(sf->uc.uc_mcontext.v2abi), 
&v2abi,
   109sizeof(sf->uc.uc_mcontext.v2abi));
   110  }
   111  
   112  err |= __copy_to_user(&sf->uc.uc_sigmask, set, 
sizeof(sigset_t));
   113  
   114  return err ? -EFAULT : 0;
   115  }
   116  

---
0-DAY CI Kernel Test Service, Intel Corporation
https://lists.01.org/hyperkitty/list/kbuild-...@lists.01.org


.config.gz
Description: application/gzip
___
linux-snps-arc mailing list
linux-snps-arc@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-snps-arc

Re: [PATCH] ARC: fix CONFIG_HARDENED_USERCOPY

2021-06-10 Thread Vineet Gupta 
On 6/10/21 10:02 AM, Kees Cook wrote:
> On Wed, Jun 09, 2021 at 03:12:11PM -0700, Vineet Gupta wrote:
>> Currently enabling this triggers a warning
>>
>> | usercopy: Kernel memory overwrite attempt detected to kernel text (offset 
>> 155633, size 11)!
>> | usercopy: BUG: failure at mm/usercopy.c:99/usercopy_abort()!
>> |
>> |gcc generated __builtin_trap
>> |Path: /bin/busybox
>> |CPU: 0 PID: 84 Comm: init Not tainted 5.4.22
>> |
>> |[ECR ]: 0x00090005 => gcc generated __builtin_trap
>> |[EFA ]: 0x9024fcaa
>> |[BLINK ]: usercopy_abort+0x8a/0x8c
>> |[ERET ]: memfd_fcntl+0x0/0x470
>> |[STAT32]: 0x80080802 : IE K
>> |BTA: 0x901ba38c SP: 0xbe161ecc FP: 0xbf9fe950
>> |LPS: 0x90677408 LPE: 0x9067740c LPC: 0x
>> |r00: 0x003c r01: 0xbf0ed280 r02: 0x
>> |r03: 0xbe15fa30 r04: 0x00d2803e r05: 0x
>> |r06: 0x675d7000 r07: 0x r08: 0x675d9c00
>> |r09: 0x r10: 0x035c r11: 0x61206572
>> |r12: 0x9024fcaa r13: 0x000b r14: 0x000b
>> |r15: 0x r16: 0x90169ffc r17: 0x90168000
>> |r18: 0x r19: 0xbf092010 r20: 0x0001
>> |r21: 0x0011 r22: 0x5ff1 r23: 0x90169ff1
>> |r24: 0xbe196c00 r25: 0xbf0ed280
>> |
>> |Stack Trace:
>> | memfd_fcntl+0x0/0x470
>> | usercopy_abort+0x8a/0x8c
>> | __check_object_size+0x10e/0x138
>> | copy_strings+0x1f4/0x38c
>> | __do_execve_file+0x352/0x848
>> | EV_Trap+0xcc/0xd0
> What was the root cause here? Was it that the init section gets freed
> and reused for kmalloc?

Right. ARC _stext was encompassing the init section (to cover the init 
code) so when init gets freed and used by kmalloc, 
check_kernel_text_object() trips as it thinks the allocated pointer is 
in kernel .text. Actually I should have added this to changelog.

Thx,
-Vineet

___
linux-snps-arc mailing list
linux-snps-arc@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-snps-arc

[PATCH v2] ARCv2: save ABI registers across signal handling

2021-06-10 Thread Vineet Gupta 
ARCv2 has some configuration dependent registers (r30, r58, r59) which
could be targetted by the compiler. To keep the ABI stable, these were
unconditionally part of the glibc ABI
(sysdeps/unix/sysv/linux/arc/sys/ucontext.h:mcontext_t) however we
missed populating them (by saving/restoring them across signal
handling).

This patch fixes the issue by
 - adding arcv2 ABI regs to kernel struct sigcontext
 - populating them during signal handling

Change to struct sigcontext might seem like a glibc ABI change (although
it primarily uses ucontext_t:mcontext_t) but the fact is
 - it has only been extended (existing fields are not touched)
 - the old sigcontext was ABI incomplete to begin with anyways

Fixes: https://github.com/foss-for-synopsys-dwc-arc-processors/linux/issues/53
Cc: 
Tested-by: kernel test robot 
Reported-by: Vladimir Isaev 
Signed-off-by: Vineet Gupta 
---
 arch/arc/include/uapi/asm/sigcontext.h |  1 +
 arch/arc/kernel/signal.c   | 43 ++
 2 files changed, 44 insertions(+)

diff --git a/arch/arc/include/uapi/asm/sigcontext.h 
b/arch/arc/include/uapi/asm/sigcontext.h
index 95f8a4380e11..7a5449dfcb29 100644
--- a/arch/arc/include/uapi/asm/sigcontext.h
+++ b/arch/arc/include/uapi/asm/sigcontext.h
@@ -18,6 +18,7 @@
  */
 struct sigcontext {
struct user_regs_struct regs;
+   struct user_regs_arcv2 v2abi;
 };
 
 #endif /* _ASM_ARC_SIGCONTEXT_H */
diff --git a/arch/arc/kernel/signal.c b/arch/arc/kernel/signal.c
index b3ccb9e5ffe4..cb2f88502baf 100644
--- a/arch/arc/kernel/signal.c
+++ b/arch/arc/kernel/signal.c
@@ -61,6 +61,41 @@ struct rt_sigframe {
unsigned int sigret_magic;
 };
 
+static int save_arcv2_regs(struct sigcontext *mctx, struct pt_regs *regs)
+{
+   int err = 0;
+#ifndef CONFIG_ISA_ARCOMPACT
+   struct user_regs_arcv2 v2abi;
+
+   v2abi.r30 = regs->r30;
+#ifdef CONFIG_ARC_HAS_ACCL_REGS
+   v2abi.r58 = regs->r58;
+   v2abi.r59 = regs->r59;
+#else
+   v2abi.r58 = v2abi.r59 = 0;
+#endif
+   err = __copy_to_user(&mctx->v2abi, &v2abi, sizeof(v2abi));
+#endif
+   return err;
+}
+
+static int restore_arcv2_regs(struct sigcontext *mctx, struct pt_regs *regs)
+{
+   int err = 0;
+#ifndef CONFIG_ISA_ARCOMPACT
+   struct user_regs_arcv2 v2abi;
+
+   err = __copy_from_user(&v2abi, &mctx->v2abi, sizeof(v2abi));
+
+   regs->r30 = v2abi.r30;
+#ifdef CONFIG_ARC_HAS_ACCL_REGS
+   regs->r58 = v2abi.r58;
+   regs->r59 = v2abi.r59;
+#endif
+#endif
+   return err;
+}
+
 static int
 stash_usr_regs(struct rt_sigframe __user *sf, struct pt_regs *regs,
   sigset_t *set)
@@ -94,6 +129,10 @@ stash_usr_regs(struct rt_sigframe __user *sf, struct 
pt_regs *regs,
 
err = __copy_to_user(&(sf->uc.uc_mcontext.regs.scratch), &uregs.scratch,
 sizeof(sf->uc.uc_mcontext.regs.scratch));
+
+   if (is_isa_arcv2())
+   err |= save_arcv2_regs(&(sf->uc.uc_mcontext), regs);
+
err |= __copy_to_user(&sf->uc.uc_sigmask, set, sizeof(sigset_t));
 
return err ? -EFAULT : 0;
@@ -109,6 +148,10 @@ static int restore_usr_regs(struct pt_regs *regs, struct 
rt_sigframe __user *sf)
err |= __copy_from_user(&uregs.scratch,
&(sf->uc.uc_mcontext.regs.scratch),
sizeof(sf->uc.uc_mcontext.regs.scratch));
+
+   if (is_isa_arcv2())
+   err |= restore_arcv2_regs(&(sf->uc.uc_mcontext), regs);
+
if (err)
return -EFAULT;
 
-- 
2.25.1


___
linux-snps-arc mailing list
linux-snps-arc@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-snps-arc

Re: [PATCH] ARC: fix CONFIG_HARDENED_USERCOPY

2021-06-10 Thread Kees Cook 
On Thu, Jun 10, 2021 at 06:56:48PM +, Vineet Gupta wrote:
> On 6/10/21 10:02 AM, Kees Cook wrote:
> > On Wed, Jun 09, 2021 at 03:12:11PM -0700, Vineet Gupta wrote:
> >> Currently enabling this triggers a warning
> >>
> >> | usercopy: Kernel memory overwrite attempt detected to kernel text 
> >> (offset 155633, size 11)!
> >> | usercopy: BUG: failure at mm/usercopy.c:99/usercopy_abort()!
> >> |
> >> |gcc generated __builtin_trap
> >> |Path: /bin/busybox
> >> |CPU: 0 PID: 84 Comm: init Not tainted 5.4.22
> >> |
> >> |[ECR ]: 0x00090005 => gcc generated __builtin_trap
> >> |[EFA ]: 0x9024fcaa
> >> |[BLINK ]: usercopy_abort+0x8a/0x8c
> >> |[ERET ]: memfd_fcntl+0x0/0x470
> >> |[STAT32]: 0x80080802 : IE K
> >> |BTA: 0x901ba38c SP: 0xbe161ecc FP: 0xbf9fe950
> >> |LPS: 0x90677408 LPE: 0x9067740c LPC: 0x
> >> |r00: 0x003c r01: 0xbf0ed280 r02: 0x
> >> |r03: 0xbe15fa30 r04: 0x00d2803e r05: 0x
> >> |r06: 0x675d7000 r07: 0x r08: 0x675d9c00
> >> |r09: 0x r10: 0x035c r11: 0x61206572
> >> |r12: 0x9024fcaa r13: 0x000b r14: 0x000b
> >> |r15: 0x r16: 0x90169ffc r17: 0x90168000
> >> |r18: 0x r19: 0xbf092010 r20: 0x0001
> >> |r21: 0x0011 r22: 0x5ff1 r23: 0x90169ff1
> >> |r24: 0xbe196c00 r25: 0xbf0ed280
> >> |
> >> |Stack Trace:
> >> | memfd_fcntl+0x0/0x470
> >> | usercopy_abort+0x8a/0x8c
> >> | __check_object_size+0x10e/0x138
> >> | copy_strings+0x1f4/0x38c
> >> | __do_execve_file+0x352/0x848
> >> | EV_Trap+0xcc/0xd0
> > What was the root cause here? Was it that the init section gets freed
> > and reused for kmalloc?
> 
> Right. ARC _stext was encompassing the init section (to cover the init 
> code) so when init gets freed and used by kmalloc, 
> check_kernel_text_object() trips as it thinks the allocated pointer is 
> in kernel .text. Actually I should have added this to changelog.

Great! Yeah, if you respin it with that added, please consider it:

Reviewed-by: Kees Cook 

Thanks!

-- 
Kees Cook

___
linux-snps-arc mailing list
linux-snps-arc@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-snps-arc

Re: [linux-next:master 8465/8758] arch/arc/kernel/signal.c:101:21: error: 'struct pt_regs' has no member named 'r30'; did you mean 'r10'?

2021-06-10 Thread Vineet Gupta 
On 6/10/21 2:36 PM, kernel test robot wrote:
> Hi Vineet,
>
> FYI, the error/warning still remains.

I posted the v2 patch but didn't yet push my branch. Now done.

Thx,
-Vineet

>
> tree:   
> https://urldefense.com/v3/__https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git__;!!A4F2R9G_pg!OKqfde4ua3ZrR7XYJtEqASSTLKtjW1iEEeBD5V38iLgNZ9l3CBkaluPc9FDW_E5l$
>   master
> head:   50a1180e6cf12462bbbf3f2ebc5b93094ed9abee
> commit: 98ec2edf58c820ef953fbdfcf98d706aa804b822 [8465/8758] ARCv2: save ABI 
> registers across signal handling
> config: arc-randconfig-r001-20210610 (attached as .config)
> compiler: arceb-elf-gcc (GCC) 9.3.0
> reproduce (this is a W=1 build):
>  wget 
> https://urldefense.com/v3/__https://raw.githubusercontent.com/intel/lkp-tests/master/sbin/make.cross__;!!A4F2R9G_pg!OKqfde4ua3ZrR7XYJtEqASSTLKtjW1iEEeBD5V38iLgNZ9l3CBkaluPc9Cao0rHM$
>   -O ~/bin/make.cross
>  chmod +x ~/bin/make.cross
>  # 
> https://urldefense.com/v3/__https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/commit/?id=98ec2edf58c820ef953fbdfcf98d706aa804b822__;!!A4F2R9G_pg!OKqfde4ua3ZrR7XYJtEqASSTLKtjW1iEEeBD5V38iLgNZ9l3CBkaluPc9J7KfXQN$
>  git remote add linux-next 
> https://urldefense.com/v3/__https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git__;!!A4F2R9G_pg!OKqfde4ua3ZrR7XYJtEqASSTLKtjW1iEEeBD5V38iLgNZ9l3CBkaluPc9FDW_E5l$
>  git fetch --no-tags linux-next master
>  git checkout 98ec2edf58c820ef953fbdfcf98d706aa804b822
>  # save the attached .config to linux build tree
>  COMPILER_INSTALL_PATH=$HOME/0day COMPILER=gcc-9.3.0 make.cross 
> ARCH=arc
>
> If you fix the issue, kindly add following tag as appropriate
> Reported-by: kernel test robot 
>
> All errors (new ones prefixed by >>):
>
> arch/arc/kernel/signal.c: In function 'stash_usr_regs':
>>> arch/arc/kernel/signal.c:101:21: error: 'struct pt_regs' has no member 
>>> named 'r30'; did you mean 'r10'?
>   101 |   v2abi.r30 = regs->r30;
>   | ^~~
>   | r10
> arch/arc/kernel/signal.c: In function 'restore_usr_regs':
> arch/arc/kernel/signal.c:134:9: error: 'struct pt_regs' has no member 
> named 'r30'; did you mean 'r10'?
>   134 |   regs->r30 = v2abi.r30;
>   | ^~~
>   | r10
> arch/arc/kernel/signal.c: At top level:
> arch/arc/kernel/signal.c:387:6: warning: no previous prototype for 
> 'do_signal' [-Wmissing-prototypes]
>   387 | void do_signal(struct pt_regs *regs)
>   |  ^
> arch/arc/kernel/signal.c:420:6: warning: no previous prototype for 
> 'do_notify_resume' [-Wmissing-prototypes]
>   420 | void do_notify_resume(struct pt_regs *regs)
>   |  ^~~~
>
>
> vim +101 arch/arc/kernel/signal.c
>
>  63   
>  64   static int
>  65   stash_usr_regs(struct rt_sigframe __user *sf, struct pt_regs 
> *regs,
>  66  sigset_t *set)
>  67   {
>  68   int err;
>  69   struct user_regs_struct uregs;
>  70   
>  71   uregs.scratch.bta   = regs->bta;
>  72   uregs.scratch.lp_start  = regs->lp_start;
>  73   uregs.scratch.lp_end= regs->lp_end;
>  74   uregs.scratch.lp_count  = regs->lp_count;
>  75   uregs.scratch.status32  = regs->status32;
>  76   uregs.scratch.ret   = regs->ret;
>  77   uregs.scratch.blink = regs->blink;
>  78   uregs.scratch.fp= regs->fp;
>  79   uregs.scratch.gp= regs->r26;
>  80   uregs.scratch.r12   = regs->r12;
>  81   uregs.scratch.r11   = regs->r11;
>  82   uregs.scratch.r10   = regs->r10;
>  83   uregs.scratch.r9= regs->r9;
>  84   uregs.scratch.r8= regs->r8;
>  85   uregs.scratch.r7= regs->r7;
>  86   uregs.scratch.r6= regs->r6;
>  87   uregs.scratch.r5= regs->r5;
>  88   uregs.scratch.r4= regs->r4;
>  89   uregs.scratch.r3= regs->r3;
>  90   uregs.scratch.r2= regs->r2;
>  91   uregs.scratch.r1= regs->r1;
>  92   uregs.scratch.r0= regs->r0;
>  93

Re: [PATCH] ARC: fix CONFIG_HARDENED_USERCOPY

2021-06-10 Thread Vineet Gupta 
On 6/10/21 4:56 PM, Kees Cook wrote:
 |Stack Trace:
 | memfd_fcntl+0x0/0x470
 | usercopy_abort+0x8a/0x8c
 | __check_object_size+0x10e/0x138
 | copy_strings+0x1f4/0x38c
 | __do_execve_file+0x352/0x848
 | EV_Trap+0xcc/0xd0
>>> What was the root cause here? Was it that the init section gets freed
>>> and reused for kmalloc?
>> Right. ARC _stext was encompassing the init section (to cover the init
>> code) so when init gets freed and used by kmalloc,
>> check_kernel_text_object() trips as it thinks the allocated pointer is
>> in kernel .text. Actually I should have added this to changelog.
> Great! Yeah, if you respin it with that added, please consider it:
>
> Reviewed-by: Kees Cook 

Thx. I added this and pushed to ARC for-curr

--->
     The issue is triggered by an allocation in "init reclaimed" region.
     ARC _stext emcompasses the init region (for historical reasons we 
wanted
     the init.text to be under .text as well). This however trips up
     __check_object_size()->check_kernel_text_object() which treats this as
     object bleedign into kernel text.

     Fix that by rezoning _stext to start from regular kernel .text and 
leave
     out .init altogether.

___
linux-snps-arc mailing list
linux-snps-arc@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-snps-arc