On Wed, Jun 18, 2025 at 09:05:23AM +0900, Masami Hiramatsu (Google) wrote:
From: Masami Hiramatsu (Google) mhiramat@kernel.org
Since smp_text_poke_single() does not expect there is another text_poke request is queued, it can make text_poke_array not sorted or cause a buffer overflow on the text_poke_array.vec[]. This will cause an Oops in int3 because of bsearch failing;
CPU 0 CPU 1 CPU 2
smp_text_poke_batch_add()
smp_text_poke_single() <<-- Adds out of order <int3> [Fails o find address in text_poke_array ] OOPS!Or unhandled page fault because of a buffer overflow;
CPU 0 CPU 1
smp_text_poke_batch_add() <<+ ... | smp_text_poke_batch_add() <<-- Adds TEXT_POKE_ARRAY_MAX times.
smp_text_poke_single() { __smp_text_poke_batch_add() <<-- Adds entry at TEXT_POKE_ARRAY_MAX + 1 smp_text_poke_batch_finish() [Unhandled page fault because text_poke_array.nr_entries is overwritten] BUG! }Use smp_text_poke_batch_add() instead of __smp_text_poke_batch_add() so that it correctly flush the queue if needed.
Reported-by: Linux Kernel Functional Testing lkft@linaro.org Closes: https://lore.kernel.org/all/CA+G9fYsLu0roY3DV=tKyqP7FEKbOEETRvTDhnpPxJGbA=Cg... Fixes: c8976ade0c1b ("x86/alternatives: Simplify smp_text_poke_single() by using tp_vec and existing APIs") Signed-off-by: Masami Hiramatsu (Google) mhiramat@kernel.org Reviewed-by: Steven Rostedt (Google) rostedt@goodmis.org Tested-by: Linux Kernel Functional Testing lkft@linaro.org
Thanks!