On 09/04/2024 1:50 pm, Roger Pau Monne wrote:
> The code in _apply_alternatives() will unconditionally attempt to read
> __initdata_cf_clobber_{start,end} when called as part of applying alternatives
> to a livepatch payload.
When CET-IBT is active.
In practice this narrows the impact to ADL/RPL and SPR/EMR.
> That leads to a page-fault as
> __initdata_cf_clobber_{start,end} living in .init section will have been
> unmapped by the time a livepatch gets loaded.
>
> Fix by adding a check that limits the clobbering of endbr64 instructions to
> boot time only.
>
> Fixes: 37ed5da851b8 ('x86/altcall: Optimise away endbr64 instruction where
> possible')
> Signed-off-by: Roger Pau Monné <roger....@citrix.com>
Reviewed-by: Andrew Cooper <andrew.coop...@citrix.com>
In hindsight I really should have tried livepatching when I was doing
the IBT work, but that was also done under an embargo deadline.
I'm happy to tweak the commit message on commit.
