On Fri Feb 3, 2023 at 12:02 PM AEST, Benjamin Gray wrote:

On Fri, 2023-02-03 at 00:46 +0100, Erhard F. wrote:

quoted

Happened during boot:

[...]
Creating 6 MTD partitions on "flash@0":
0x000000000000-0x000004000000 : "PNOR"
0x000001b21000-0x000003921000 : "BOOTKERNEL"
0x000003a44000-0x000003a68000 : "CAPP"
0x000003a88000-0x000003a89000 : "VERSION"
0x000003a89000-0x000003ac9000 : "IMA_CATALOG"
0x000003e10000-0x000004000000 : "BOOTKERNFW"
BTRFS info: devid 1 device path /dev/root changed to /dev/nvme0n1p3
scanned by systemd-udevd (387)
Kernel attempted to write user page (aa55c280000) - exploit attempt?
(uid: 0)
------------[ cut here ]------------
Bug: Write fault blocked by KUAP!

KUAP is a red herring of course, the KUAP test just checks if the
faulting address is below TASK_SIZE.

[snip]

quoted

--- interrupt: 300 at __patch_instruction+0x50/0x70

NIP:  c000000000064670 LR: c000000000064c2c CTR: c000000000048ee0
REGS: c000000023b57630 TRAP: 0300   Tainted: G                T  
(6.2.0-rc6-P9)
MSR:  900000000280b032 <SF,HV,VEC,VSX,EE,FP,ME,IR,DR,RI>  CR:
24222244  XER: 00000000
CFAR: c00000000006462c DAR: 00000aa55c280000 DSISR: 42000000 IRQMASK:

                                            ^^^^        ^^
First byte of page, store, no PTE.

quoted

1 
GPR00: 0000000000000000 c000000023b578d0 c000000000e7cc00
c00800000ce33ffc 
GPR04: 041ae13000000000 00000aa55c27fffc 0000000000000000

                                        ^^^^
Last word of previous page.

Probably from create_stub function descriptor patching, which is not
actually patching in an instruction so it probably gets unlucky and
gets some data that matches prefix opcode and so it tries to store
8 bytes.

So not your bug, your temp mm code just exposed it. Data shouldn't
be patched using patch_instruction. We should have a patch_data_u32
or similar that doesn't use instructions.

Thanks,
Nick