* static_key_enable_cpuslocked(): static key 'security_hook_active_locked_down_0+0x0/0x10' used before call to jump_label_init()
@ 2024-07-30 11:34 Borislav Petkov
2024-07-30 13:43 ` Borislav Petkov
2024-07-30 15:02 ` Paul Moore
0 siblings, 2 replies; 8+ messages in thread
From: Borislav Petkov @ 2024-07-30 11:34 UTC (permalink / raw)
To: linux-security-module
Cc: Paul Moore, James Morris, Serge E. Hallyn, Narasimhan V, lkml
Hi,
this is with today's linux-next:
...
09:44:13 [console-expect]#kexec -e
09:44:13 kexec -e
09:44:16 ^[[?2004l^M[ 0.000000] Linux version 6.11.0-rc1-next-20240730-1722324631886 (gcc (Ubuntu 11.4.0-1ubuntu1~22.04) 11.4.0, GNU ld (GNU Binutils for Ubuntu) 2.38) #1 SMP PREEMPT_DYNAMIC Tue Jul 30 07:40:55 UTC 2024
09:44:16 [ 0.000000] ------------[ cut here ]------------
09:44:16 [ 0.000000] WARNING: CPU: 0 PID: 0 at kernel/static_call_inline.c:153 __static_call_update+0x1c6/0x220
09:44:16 [ 0.000000] Modules linked in:
09:44:16 [ 0.000000] CPU: 0 UID: 0 PID: 0 Comm: swapper Not tainted 6.11.0-rc1-next-20240730-1722324631886 #1
09:44:16 [ 0.000000] RIP: 0010:__static_call_update+0x1c6/0x220
09:44:16 [ 0.000000] Code: 87 5b eb d9 00 a8 01 0f 85 6c ff ff ff 4c 89 ee 48 c7 c7 e0 fb a2 8c c6 05 44 63 2b 02 01 e8 b1 00 d9 ff 0f 0b e9 4f ff ff ff <0f> 0b 48 c7 c7 40 fc 40 8d e8 dc 52 e1 00 e8 a7 23 d9 ff 48 8b 45
09:44:16 [ 0.000000] RSP: 0000:ffffffff8d203dd0 EFLAGS: 00010046 ORIG_RAX: 0000000000000000
09:44:16 [ 0.000000] RAX: 0000000000000000 RBX: ffffffff8b7e3250 RCX: 000000006690cbe9
09:44:16 [ 0.000000] RDX: 0000000000000000 RSI: ffffffff8dbae58c RDI: ffffffff8d2867a0
09:44:16 [ 0.000000] RBP: ffffffff8d203e38 R08: 00000000ff6690cb R09: 2035353a30343a37
09:44:16 [ 0.000000] R10: 3230322043545520 R11: 35353a30343a3730 R12: ffffffff8c17a180
09:44:16 [ 0.000000] R13: ffffffff8c48db10 R14: ffffffff8d4c7030 R15: 0000000000000000
09:44:16 [ 0.000000] FS: 0000000000000000(0000) GS:ffffffff8d69c000(0000) knlGS:0000000000000000
09:44:16 [ 0.000000] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
09:44:16 [ 0.000000] CR2: ff1100007047d000 CR3: 00000000745c2000 CR4: 00000000000010b0
09:44:16 [ 0.000000] Call Trace:
09:44:16 [ 0.000000] <TASK>
09:44:16 [ 0.000000] ? show_regs+0x6d/0x80
09:44:16 [ 0.000000] ? __warn+0x91/0x140
09:44:16 [ 0.000000] ? __static_call_update+0x1c6/0x220
09:44:16 [ 0.000000] ? report_bug+0x193/0x1a0
09:44:16 [ 0.000000] ? __pfx_lockdown_is_locked_down+0x10/0x10
09:44:16 [ 0.000000] ? early_fixup_exception+0xa6/0xd0
09:44:16 [ 0.000000] ? do_early_exception+0x27/0x70
09:44:16 [ 0.000000] ? __SCT__lsm_static_call_bpf_token_capable_11+0x8/0x8
09:44:17 [ 0.000000] ? early_idt_handler_common+0x2f/0x3a
09:44:17 [ 0.000000] ? __SCT__lsm_static_call_bpf_token_capable_11+0x8/0x8
09:44:17 [ 0.000000] ? __pfx_lockdown_is_locked_down+0x10/0x10
09:44:17 [ 0.000000] ? __static_call_update+0x1c6/0x220
09:44:17 [ 0.000000] ? __pfx_lockdown_is_locked_down+0x10/0x10
09:44:17 [ 0.000000] ? vprintk_emit+0xb5/0x410
09:44:17 [ 0.000000] security_add_hooks+0xbd/0x150
09:44:17 [ 0.000000] lockdown_lsm_init+0x25/0x30
09:44:17 [ 0.000000] initialize_lsm+0x38/0x90
09:44:17 [ 0.000000] early_security_init+0x36/0x70
09:44:17 [ 0.000000] start_kernel+0x5f/0xb50
09:44:17 [ 0.000000] x86_64_start_reservations+0x1c/0x30
09:44:17 [ 0.000000] x86_64_start_kernel+0xbf/0x110
09:44:17 [ 0.000000] ? setup_ghcb+0x12/0x130
09:44:17 [ 0.000000] common_startup_64+0x13e/0x141
09:44:17 [ 0.000000] </TASK>
09:44:17 [ 0.000000] ---[ end trace 0000000000000000 ]---
09:44:17 [ 0.000000] ------------[ cut here ]------------
09:44:17 [ 0.000000] static_key_enable_cpuslocked(): static key 'security_hook_active_locked_down_0+0x0/0x10' used before call to jump_label_init()
09:44:17 [ 0.000000] WARNING: CPU: 0 PID: 0 at kernel/jump_label.c:199 static_key_enable_cpuslocked+0x99/0xb0
09:44:17 [ 0.000000] Modules linked in:
09:44:17 [ 0.000000] CPU: 0 UID: 0 PID: 0 Comm: swapper Tainted: G W 6.11.0-rc1-next-20240730-1722324631886 #1
09:44:17 [ 0.000000] Tainted: [W]=WARN
09:44:17 [ 0.000000] RIP: 0010:static_key_enable_cpuslocked+0x99/0xb0
09:44:17 [ 0.000000] Code: ff ff ff ff 48 89 df e8 45 fd ff ff c7 03 01 00 00 00 eb d5 48 89 da 48 c7 c6 e0 0a 44 8c 48 c7 c7 b8 00 a3 8c e8 87 f6 d6 ff <0f> 0b eb 8e 0f 0b eb 9c 66 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40
09:44:17 [ 0.000000] RSP: 0000:ffffffff8d203e10 EFLAGS: 00010086 ORIG_RAX: 0000000000000000
09:44:17 [ 0.000000] RAX: 0000000000000000 RBX: ffffffff8dd6aaf0 RCX: 0000000000000084
09:44:17 [ 0.000000] RDX: ffffffff8d349400 RSI: 00000000ffffe02c RDI: ffffffff8d203cb0
09:44:17 [ 0.000000] RBP: ffffffff8d203e20 R08: 000000000000007e R09: 6562616c5f706d75
09:44:17 [ 0.000000] R10: 6a206f74206c6c61 R11: 632065726f666562 R12: 0000000000000000
09:44:17 [ 0.000000] R13: ffffffff8c48db10 R14: ffffffff8cb0e2f8 R15: 0000000000000000
09:44:17 [ 0.000000] FS: 0000000000000000(0000) GS:ffffffff8d69c000(0000) knlGS:0000000000000000
09:44:17 [ 0.000000] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
09:44:17 [ 0.000000] CR2: ff1100007047d000 CR3: 00000000745c2000 CR4: 00000000000010b0
09:44:17 [ 0.000000] Call Trace:
09:44:17 [ 0.000000] <TASK>
09:44:17 [ 0.000000] ? show_regs+0x6d/0x80
09:44:17 [ 0.000000] ? __warn+0x91/0x140
09:44:17 [ 0.000000] ? static_key_enable_cpuslocked+0x99/0xb0
09:44:17 [ 0.000000] ? report_bug+0x193/0x1a0
09:44:17 [ 0.000000] ? fixup_exception+0x2b/0x340
09:44:17 [ 0.000000] ? early_fixup_exception+0xa6/0xd0
09:44:17 [ 0.000000] ? do_early_exception+0x27/0x70
09:44:17 [ 0.000000] ? early_idt_handler_common+0x2f/0x3a
09:44:17 [ 0.000000] ? static_key_enable_cpuslocked+0x99/0xb0
09:44:17 [ 0.000000] static_key_enable+0x1f/0x30
09:44:17 [ 0.000000] security_add_hooks+0xce/0x150
09:44:17 [ 0.000000] lockdown_lsm_init+0x25/0x30
09:44:17 [ 0.000000] initialize_lsm+0x38/0x90
09:44:17 [ 0.000000] early_security_init+0x36/0x70
09:44:17 [ 0.000000] start_kernel+0x5f/0xb50
09:44:17 [ 0.000000] x86_64_start_reservations+0x1c/0x30
09:44:17 [ 0.000000] x86_64_start_kernel+0xbf/0x110
09:44:17 [ 0.000000] ? setup_ghcb+0x12/0x130
09:44:17 [ 0.000000] common_startup_64+0x13e/0x141
09:44:17 [ 0.000000] </TASK>
09:44:17 [ 0.000000] ---[ end trace 0000000000000000 ]---
...
--
Regards/Gruss,
Boris.
https://people.kernel.org/tglx/notes-about-netiquette
^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: static_key_enable_cpuslocked(): static key 'security_hook_active_locked_down_0+0x0/0x10' used before call to jump_label_init()
2024-07-30 11:34 static_key_enable_cpuslocked(): static key 'security_hook_active_locked_down_0+0x0/0x10' used before call to jump_label_init() Borislav Petkov
@ 2024-07-30 13:43 ` Borislav Petkov
2024-07-30 15:02 ` Paul Moore
1 sibling, 0 replies; 8+ messages in thread
From: Borislav Petkov @ 2024-07-30 13:43 UTC (permalink / raw)
To: linux-security-module
Cc: Paul Moore, James Morris, Serge E. Hallyn, Narasimhan V, lkml
On Tue, Jul 30, 2024 at 01:34:19PM +0200, Borislav Petkov wrote:
> Hi,
>
> this is with today's linux-next:
>
> ...
>
> 09:44:13 [console-expect]#kexec -e
> 09:44:13 kexec -e
> 09:44:16 ^[[?2004l^M[ 0.000000] Linux version 6.11.0-rc1-next-20240730-1722324631886 (gcc (Ubuntu 11.4.0-1ubuntu1~22.04) 11.4.0, GNU ld (GNU Binutils for Ubuntu) 2.38) #1 SMP PREEMPT_DYNAMIC Tue Jul 30 07:40:55 UTC 2024
> 09:44:16 [ 0.000000] ------------[ cut here ]------------
> 09:44:16 [ 0.000000] WARNING: CPU: 0 PID: 0 at kernel/static_call_inline.c:153 __static_call_update+0x1c6/0x220
> 09:44:16 [ 0.000000] Modules linked in:
> 09:44:16 [ 0.000000] CPU: 0 UID: 0 PID: 0 Comm: swapper Not tainted 6.11.0-rc1-next-20240730-1722324631886 #1
> 09:44:16 [ 0.000000] RIP: 0010:__static_call_update+0x1c6/0x220
> 09:44:16 [ 0.000000] Code: 87 5b eb d9 00 a8 01 0f 85 6c ff ff ff 4c 89 ee 48 c7 c7 e0 fb a2 8c c6 05 44 63 2b 02 01 e8 b1 00 d9 ff 0f 0b e9 4f ff ff ff <0f> 0b 48 c7 c7 40 fc 40 8d e8 dc 52 e1 00 e8 a7 23 d9 ff 48 8b 45
> 09:44:16 [ 0.000000] RSP: 0000:ffffffff8d203dd0 EFLAGS: 00010046 ORIG_RAX: 0000000000000000
> 09:44:16 [ 0.000000] RAX: 0000000000000000 RBX: ffffffff8b7e3250 RCX: 000000006690cbe9
> 09:44:16 [ 0.000000] RDX: 0000000000000000 RSI: ffffffff8dbae58c RDI: ffffffff8d2867a0
> 09:44:16 [ 0.000000] RBP: ffffffff8d203e38 R08: 00000000ff6690cb R09: 2035353a30343a37
> 09:44:16 [ 0.000000] R10: 3230322043545520 R11: 35353a30343a3730 R12: ffffffff8c17a180
> 09:44:16 [ 0.000000] R13: ffffffff8c48db10 R14: ffffffff8d4c7030 R15: 0000000000000000
> 09:44:16 [ 0.000000] FS: 0000000000000000(0000) GS:ffffffff8d69c000(0000) knlGS:0000000000000000
> 09:44:16 [ 0.000000] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> 09:44:16 [ 0.000000] CR2: ff1100007047d000 CR3: 00000000745c2000 CR4: 00000000000010b0
> 09:44:16 [ 0.000000] Call Trace:
> 09:44:16 [ 0.000000] <TASK>
> 09:44:16 [ 0.000000] ? show_regs+0x6d/0x80
> 09:44:16 [ 0.000000] ? __warn+0x91/0x140
> 09:44:16 [ 0.000000] ? __static_call_update+0x1c6/0x220
> 09:44:16 [ 0.000000] ? report_bug+0x193/0x1a0
> 09:44:16 [ 0.000000] ? __pfx_lockdown_is_locked_down+0x10/0x10
> 09:44:16 [ 0.000000] ? early_fixup_exception+0xa6/0xd0
> 09:44:16 [ 0.000000] ? do_early_exception+0x27/0x70
> 09:44:16 [ 0.000000] ? __SCT__lsm_static_call_bpf_token_capable_11+0x8/0x8
> 09:44:17 [ 0.000000] ? early_idt_handler_common+0x2f/0x3a
> 09:44:17 [ 0.000000] ? __SCT__lsm_static_call_bpf_token_capable_11+0x8/0x8
> 09:44:17 [ 0.000000] ? __pfx_lockdown_is_locked_down+0x10/0x10
> 09:44:17 [ 0.000000] ? __static_call_update+0x1c6/0x220
> 09:44:17 [ 0.000000] ? __pfx_lockdown_is_locked_down+0x10/0x10
> 09:44:17 [ 0.000000] ? vprintk_emit+0xb5/0x410
> 09:44:17 [ 0.000000] security_add_hooks+0xbd/0x150
> 09:44:17 [ 0.000000] lockdown_lsm_init+0x25/0x30
> 09:44:17 [ 0.000000] initialize_lsm+0x38/0x90
> 09:44:17 [ 0.000000] early_security_init+0x36/0x70
> 09:44:17 [ 0.000000] start_kernel+0x5f/0xb50
> 09:44:17 [ 0.000000] x86_64_start_reservations+0x1c/0x30
> 09:44:17 [ 0.000000] x86_64_start_kernel+0xbf/0x110
> 09:44:17 [ 0.000000] ? setup_ghcb+0x12/0x130
> 09:44:17 [ 0.000000] common_startup_64+0x13e/0x141
> 09:44:17 [ 0.000000] </TASK>
> 09:44:17 [ 0.000000] ---[ end trace 0000000000000000 ]---
> 09:44:17 [ 0.000000] ------------[ cut here ]------------
> 09:44:17 [ 0.000000] static_key_enable_cpuslocked(): static key 'security_hook_active_locked_down_0+0x0/0x10' used before call to jump_label_init()
It says so directly here:
start_kernel:
....
early_security_init(); <----
setup_arch(&command_line);
setup_boot_config();
setup_command_line(command_line);
setup_nr_cpu_ids();
setup_per_cpu_areas();
smp_prepare_boot_cpu(); /* arch-specific boot-cpu hooks */
early_numa_node_init();
boot_cpu_hotplug_init();
pr_notice("Kernel command line: %s\n", saved_command_line);
/* parameters may set static keys */
jump_label_init(); <---
That can't work this way.
--
Regards/Gruss,
Boris.
https://people.kernel.org/tglx/notes-about-netiquette
^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: static_key_enable_cpuslocked(): static key 'security_hook_active_locked_down_0+0x0/0x10' used before call to jump_label_init()
2024-07-30 11:34 static_key_enable_cpuslocked(): static key 'security_hook_active_locked_down_0+0x0/0x10' used before call to jump_label_init() Borislav Petkov
2024-07-30 13:43 ` Borislav Petkov
@ 2024-07-30 15:02 ` Paul Moore
2024-07-30 17:40 ` KP Singh
1 sibling, 1 reply; 8+ messages in thread
From: Paul Moore @ 2024-07-30 15:02 UTC (permalink / raw)
To: KP Singh
Cc: linux-security-module, James Morris, Serge E. Hallyn,
Narasimhan V, lkml, Borislav Petkov
On Tue, Jul 30, 2024 at 7:34 AM Borislav Petkov <bp@alien8.de> wrote:
>
> Hi,
>
> this is with today's linux-next:
>
> ...
>
> 09:44:13 [console-expect]#kexec -e
> 09:44:13 kexec -e
> 09:44:16 ^[[?2004l^M[ 0.000000] Linux version 6.11.0-rc1-next-20240730-1722324631886 (gcc (Ubuntu 11.4.0-1ubuntu1~22.04) 11.4.0, GNU ld (GNU Binutils for Ubuntu) 2.38) #1 SMP PREEMPT_DYNAMIC Tue Jul 30 07:40:55 UTC 2024
> 09:44:16 [ 0.000000] ------------[ cut here ]------------
> 09:44:16 [ 0.000000] WARNING: CPU: 0 PID: 0 at kernel/static_call_inline.c:153 __static_call_update+0x1c6/0x220
> 09:44:16 [ 0.000000] Modules linked in:
> 09:44:16 [ 0.000000] CPU: 0 UID: 0 PID: 0 Comm: swapper Not tainted 6.11.0-rc1-next-20240730-1722324631886 #1
> 09:44:16 [ 0.000000] RIP: 0010:__static_call_update+0x1c6/0x220
> 09:44:16 [ 0.000000] Code: 87 5b eb d9 00 a8 01 0f 85 6c ff ff ff 4c 89 ee 48 c7 c7 e0 fb a2 8c c6 05 44 63 2b 02 01 e8 b1 00 d9 ff 0f 0b e9 4f ff ff ff <0f> 0b 48 c7 c7 40 fc 40 8d e8 dc 52 e1 00 e8 a7 23 d9 ff 48 8b 45
> 09:44:16 [ 0.000000] RSP: 0000:ffffffff8d203dd0 EFLAGS: 00010046 ORIG_RAX: 0000000000000000
> 09:44:16 [ 0.000000] RAX: 0000000000000000 RBX: ffffffff8b7e3250 RCX: 000000006690cbe9
> 09:44:16 [ 0.000000] RDX: 0000000000000000 RSI: ffffffff8dbae58c RDI: ffffffff8d2867a0
> 09:44:16 [ 0.000000] RBP: ffffffff8d203e38 R08: 00000000ff6690cb R09: 2035353a30343a37
> 09:44:16 [ 0.000000] R10: 3230322043545520 R11: 35353a30343a3730 R12: ffffffff8c17a180
> 09:44:16 [ 0.000000] R13: ffffffff8c48db10 R14: ffffffff8d4c7030 R15: 0000000000000000
> 09:44:16 [ 0.000000] FS: 0000000000000000(0000) GS:ffffffff8d69c000(0000) knlGS:0000000000000000
> 09:44:16 [ 0.000000] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> 09:44:16 [ 0.000000] CR2: ff1100007047d000 CR3: 00000000745c2000 CR4: 00000000000010b0
> 09:44:16 [ 0.000000] Call Trace:
> 09:44:16 [ 0.000000] <TASK>
> 09:44:16 [ 0.000000] ? show_regs+0x6d/0x80
> 09:44:16 [ 0.000000] ? __warn+0x91/0x140
> 09:44:16 [ 0.000000] ? __static_call_update+0x1c6/0x220
> 09:44:16 [ 0.000000] ? report_bug+0x193/0x1a0
> 09:44:16 [ 0.000000] ? __pfx_lockdown_is_locked_down+0x10/0x10
> 09:44:16 [ 0.000000] ? early_fixup_exception+0xa6/0xd0
> 09:44:16 [ 0.000000] ? do_early_exception+0x27/0x70
> 09:44:16 [ 0.000000] ? __SCT__lsm_static_call_bpf_token_capable_11+0x8/0x8
> 09:44:17 [ 0.000000] ? early_idt_handler_common+0x2f/0x3a
> 09:44:17 [ 0.000000] ? __SCT__lsm_static_call_bpf_token_capable_11+0x8/0x8
> 09:44:17 [ 0.000000] ? __pfx_lockdown_is_locked_down+0x10/0x10
> 09:44:17 [ 0.000000] ? __static_call_update+0x1c6/0x220
> 09:44:17 [ 0.000000] ? __pfx_lockdown_is_locked_down+0x10/0x10
> 09:44:17 [ 0.000000] ? vprintk_emit+0xb5/0x410
> 09:44:17 [ 0.000000] security_add_hooks+0xbd/0x150
> 09:44:17 [ 0.000000] lockdown_lsm_init+0x25/0x30
> 09:44:17 [ 0.000000] initialize_lsm+0x38/0x90
> 09:44:17 [ 0.000000] early_security_init+0x36/0x70
> 09:44:17 [ 0.000000] start_kernel+0x5f/0xb50
> 09:44:17 [ 0.000000] x86_64_start_reservations+0x1c/0x30
> 09:44:17 [ 0.000000] x86_64_start_kernel+0xbf/0x110
> 09:44:17 [ 0.000000] ? setup_ghcb+0x12/0x130
> 09:44:17 [ 0.000000] common_startup_64+0x13e/0x141
> 09:44:17 [ 0.000000] </TASK>
> 09:44:17 [ 0.000000] ---[ end trace 0000000000000000 ]---
> 09:44:17 [ 0.000000] ------------[ cut here ]------------
> 09:44:17 [ 0.000000] static_key_enable_cpuslocked(): static key 'security_hook_active_locked_down_0+0x0/0x10' used before call to jump_label_init()
> 09:44:17 [ 0.000000] WARNING: CPU: 0 PID: 0 at kernel/jump_label.c:199 static_key_enable_cpuslocked+0x99/0xb0
> 09:44:17 [ 0.000000] Modules linked in:
> 09:44:17 [ 0.000000] CPU: 0 UID: 0 PID: 0 Comm: swapper Tainted: G W 6.11.0-rc1-next-20240730-1722324631886 #1
> 09:44:17 [ 0.000000] Tainted: [W]=WARN
> 09:44:17 [ 0.000000] RIP: 0010:static_key_enable_cpuslocked+0x99/0xb0
> 09:44:17 [ 0.000000] Code: ff ff ff ff 48 89 df e8 45 fd ff ff c7 03 01 00 00 00 eb d5 48 89 da 48 c7 c6 e0 0a 44 8c 48 c7 c7 b8 00 a3 8c e8 87 f6 d6 ff <0f> 0b eb 8e 0f 0b eb 9c 66 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40
> 09:44:17 [ 0.000000] RSP: 0000:ffffffff8d203e10 EFLAGS: 00010086 ORIG_RAX: 0000000000000000
> 09:44:17 [ 0.000000] RAX: 0000000000000000 RBX: ffffffff8dd6aaf0 RCX: 0000000000000084
> 09:44:17 [ 0.000000] RDX: ffffffff8d349400 RSI: 00000000ffffe02c RDI: ffffffff8d203cb0
> 09:44:17 [ 0.000000] RBP: ffffffff8d203e20 R08: 000000000000007e R09: 6562616c5f706d75
> 09:44:17 [ 0.000000] R10: 6a206f74206c6c61 R11: 632065726f666562 R12: 0000000000000000
> 09:44:17 [ 0.000000] R13: ffffffff8c48db10 R14: ffffffff8cb0e2f8 R15: 0000000000000000
> 09:44:17 [ 0.000000] FS: 0000000000000000(0000) GS:ffffffff8d69c000(0000) knlGS:0000000000000000
> 09:44:17 [ 0.000000] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> 09:44:17 [ 0.000000] CR2: ff1100007047d000 CR3: 00000000745c2000 CR4: 00000000000010b0
> 09:44:17 [ 0.000000] Call Trace:
> 09:44:17 [ 0.000000] <TASK>
> 09:44:17 [ 0.000000] ? show_regs+0x6d/0x80
> 09:44:17 [ 0.000000] ? __warn+0x91/0x140
> 09:44:17 [ 0.000000] ? static_key_enable_cpuslocked+0x99/0xb0
> 09:44:17 [ 0.000000] ? report_bug+0x193/0x1a0
> 09:44:17 [ 0.000000] ? fixup_exception+0x2b/0x340
> 09:44:17 [ 0.000000] ? early_fixup_exception+0xa6/0xd0
> 09:44:17 [ 0.000000] ? do_early_exception+0x27/0x70
> 09:44:17 [ 0.000000] ? early_idt_handler_common+0x2f/0x3a
> 09:44:17 [ 0.000000] ? static_key_enable_cpuslocked+0x99/0xb0
> 09:44:17 [ 0.000000] static_key_enable+0x1f/0x30
> 09:44:17 [ 0.000000] security_add_hooks+0xce/0x150
> 09:44:17 [ 0.000000] lockdown_lsm_init+0x25/0x30
> 09:44:17 [ 0.000000] initialize_lsm+0x38/0x90
> 09:44:17 [ 0.000000] early_security_init+0x36/0x70
> 09:44:17 [ 0.000000] start_kernel+0x5f/0xb50
> 09:44:17 [ 0.000000] x86_64_start_reservations+0x1c/0x30
> 09:44:17 [ 0.000000] x86_64_start_kernel+0xbf/0x110
> 09:44:17 [ 0.000000] ? setup_ghcb+0x12/0x130
> 09:44:17 [ 0.000000] common_startup_64+0x13e/0x141
> 09:44:17 [ 0.000000] </TASK>
> 09:44:17 [ 0.000000] ---[ end trace 0000000000000000 ]---
KP, please take a look at this as soon as you can (lore link below for
those who aren't on the list). One obvious first thing to look at is
simply moving the call to early_security_init(), but that requires
some code audit to make sure it is safe and doesn't break something
else. Of course, if we can do something with how we setup/use static
calls that is even better. I'll take a look at it myself later today,
but I'm busy with meetings for the next several hours.
If we can't resolve this in the next day or two I'm going to
bounce/revert the LSM static-call patchset from lsm/dev; not ideal,
but we can't break linux-next.
https://lore.kernel.org/linux-security-module/20240730113419.GBZqjPu6SdAt5qZKnh@fat_crate.local/
--
paul-moore.com
^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: static_key_enable_cpuslocked(): static key 'security_hook_active_locked_down_0+0x0/0x10' used before call to jump_label_init()
2024-07-30 15:02 ` Paul Moore
@ 2024-07-30 17:40 ` KP Singh
2024-07-30 20:36 ` Paul Moore
0 siblings, 1 reply; 8+ messages in thread
From: KP Singh @ 2024-07-30 17:40 UTC (permalink / raw)
To: Paul Moore
Cc: linux-security-module, James Morris, Serge E. Hallyn,
Narasimhan V, lkml, Borislav Petkov
On Tue, Jul 30, 2024 at 5:03 PM Paul Moore <paul@paul-moore.com> wrote:
>
> On Tue, Jul 30, 2024 at 7:34 AM Borislav Petkov <bp@alien8.de> wrote:
> >
> > Hi,
> >
> > this is with today's linux-next:
> >
> > ...
> >
> > 09:44:13 [console-expect]#kexec -e
> > 09:44:13 kexec -e
> > 09:44:16 ^[[?2004l^M[ 0.000000] Linux version 6.11.0-rc1-next-20240730-1722324631886 (gcc (Ubuntu 11.4.0-1ubuntu1~22.04) 11.4.0, GNU ld (GNU Binutils for Ubuntu) 2.38) #1 SMP PREEMPT_DYNAMIC Tue Jul 30 07:40:55 UTC 2024
> > 09:44:16 [ 0.000000] ------------[ cut here ]------------
> > 09:44:16 [ 0.000000] WARNING: CPU: 0 PID: 0 at kernel/static_call_inline.c:153 __static_call_update+0x1c6/0x220
> > 09:44:16 [ 0.000000] Modules linked in:
> > 09:44:16 [ 0.000000] CPU: 0 UID: 0 PID: 0 Comm: swapper Not tainted 6.11.0-rc1-next-20240730-1722324631886 #1
> > 09:44:16 [ 0.000000] RIP: 0010:__static_call_update+0x1c6/0x220
> > 09:44:16 [ 0.000000] Code: 87 5b eb d9 00 a8 01 0f 85 6c ff ff ff 4c 89 ee 48 c7 c7 e0 fb a2 8c c6 05 44 63 2b 02 01 e8 b1 00 d9 ff 0f 0b e9 4f ff ff ff <0f> 0b 48 c7 c7 40 fc 40 8d e8 dc 52 e1 00 e8 a7 23 d9 ff 48 8b 45
> > 09:44:16 [ 0.000000] RSP: 0000:ffffffff8d203dd0 EFLAGS: 00010046 ORIG_RAX: 0000000000000000
> > 09:44:16 [ 0.000000] RAX: 0000000000000000 RBX: ffffffff8b7e3250 RCX: 000000006690cbe9
> > 09:44:16 [ 0.000000] RDX: 0000000000000000 RSI: ffffffff8dbae58c RDI: ffffffff8d2867a0
> > 09:44:16 [ 0.000000] RBP: ffffffff8d203e38 R08: 00000000ff6690cb R09: 2035353a30343a37
> > 09:44:16 [ 0.000000] R10: 3230322043545520 R11: 35353a30343a3730 R12: ffffffff8c17a180
> > 09:44:16 [ 0.000000] R13: ffffffff8c48db10 R14: ffffffff8d4c7030 R15: 0000000000000000
> > 09:44:16 [ 0.000000] FS: 0000000000000000(0000) GS:ffffffff8d69c000(0000) knlGS:0000000000000000
> > 09:44:16 [ 0.000000] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> > 09:44:16 [ 0.000000] CR2: ff1100007047d000 CR3: 00000000745c2000 CR4: 00000000000010b0
> > 09:44:16 [ 0.000000] Call Trace:
> > 09:44:16 [ 0.000000] <TASK>
> > 09:44:16 [ 0.000000] ? show_regs+0x6d/0x80
> > 09:44:16 [ 0.000000] ? __warn+0x91/0x140
> > 09:44:16 [ 0.000000] ? __static_call_update+0x1c6/0x220
> > 09:44:16 [ 0.000000] ? report_bug+0x193/0x1a0
> > 09:44:16 [ 0.000000] ? __pfx_lockdown_is_locked_down+0x10/0x10
> > 09:44:16 [ 0.000000] ? early_fixup_exception+0xa6/0xd0
> > 09:44:16 [ 0.000000] ? do_early_exception+0x27/0x70
> > 09:44:16 [ 0.000000] ? __SCT__lsm_static_call_bpf_token_capable_11+0x8/0x8
> > 09:44:17 [ 0.000000] ? early_idt_handler_common+0x2f/0x3a
> > 09:44:17 [ 0.000000] ? __SCT__lsm_static_call_bpf_token_capable_11+0x8/0x8
> > 09:44:17 [ 0.000000] ? __pfx_lockdown_is_locked_down+0x10/0x10
> > 09:44:17 [ 0.000000] ? __static_call_update+0x1c6/0x220
> > 09:44:17 [ 0.000000] ? __pfx_lockdown_is_locked_down+0x10/0x10
> > 09:44:17 [ 0.000000] ? vprintk_emit+0xb5/0x410
> > 09:44:17 [ 0.000000] security_add_hooks+0xbd/0x150
> > 09:44:17 [ 0.000000] lockdown_lsm_init+0x25/0x30
> > 09:44:17 [ 0.000000] initialize_lsm+0x38/0x90
> > 09:44:17 [ 0.000000] early_security_init+0x36/0x70
> > 09:44:17 [ 0.000000] start_kernel+0x5f/0xb50
> > 09:44:17 [ 0.000000] x86_64_start_reservations+0x1c/0x30
> > 09:44:17 [ 0.000000] x86_64_start_kernel+0xbf/0x110
> > 09:44:17 [ 0.000000] ? setup_ghcb+0x12/0x130
> > 09:44:17 [ 0.000000] common_startup_64+0x13e/0x141
> > 09:44:17 [ 0.000000] </TASK>
> > 09:44:17 [ 0.000000] ---[ end trace 0000000000000000 ]---
> > 09:44:17 [ 0.000000] ------------[ cut here ]------------
> > 09:44:17 [ 0.000000] static_key_enable_cpuslocked(): static key 'security_hook_active_locked_down_0+0x0/0x10' used before call to jump_label_init()
> > 09:44:17 [ 0.000000] WARNING: CPU: 0 PID: 0 at kernel/jump_label.c:199 static_key_enable_cpuslocked+0x99/0xb0
> > 09:44:17 [ 0.000000] Modules linked in:
> > 09:44:17 [ 0.000000] CPU: 0 UID: 0 PID: 0 Comm: swapper Tainted: G W 6.11.0-rc1-next-20240730-1722324631886 #1
> > 09:44:17 [ 0.000000] Tainted: [W]=WARN
> > 09:44:17 [ 0.000000] RIP: 0010:static_key_enable_cpuslocked+0x99/0xb0
> > 09:44:17 [ 0.000000] Code: ff ff ff ff 48 89 df e8 45 fd ff ff c7 03 01 00 00 00 eb d5 48 89 da 48 c7 c6 e0 0a 44 8c 48 c7 c7 b8 00 a3 8c e8 87 f6 d6 ff <0f> 0b eb 8e 0f 0b eb 9c 66 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40
> > 09:44:17 [ 0.000000] RSP: 0000:ffffffff8d203e10 EFLAGS: 00010086 ORIG_RAX: 0000000000000000
> > 09:44:17 [ 0.000000] RAX: 0000000000000000 RBX: ffffffff8dd6aaf0 RCX: 0000000000000084
> > 09:44:17 [ 0.000000] RDX: ffffffff8d349400 RSI: 00000000ffffe02c RDI: ffffffff8d203cb0
> > 09:44:17 [ 0.000000] RBP: ffffffff8d203e20 R08: 000000000000007e R09: 6562616c5f706d75
> > 09:44:17 [ 0.000000] R10: 6a206f74206c6c61 R11: 632065726f666562 R12: 0000000000000000
> > 09:44:17 [ 0.000000] R13: ffffffff8c48db10 R14: ffffffff8cb0e2f8 R15: 0000000000000000
> > 09:44:17 [ 0.000000] FS: 0000000000000000(0000) GS:ffffffff8d69c000(0000) knlGS:0000000000000000
> > 09:44:17 [ 0.000000] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> > 09:44:17 [ 0.000000] CR2: ff1100007047d000 CR3: 00000000745c2000 CR4: 00000000000010b0
> > 09:44:17 [ 0.000000] Call Trace:
> > 09:44:17 [ 0.000000] <TASK>
> > 09:44:17 [ 0.000000] ? show_regs+0x6d/0x80
> > 09:44:17 [ 0.000000] ? __warn+0x91/0x140
> > 09:44:17 [ 0.000000] ? static_key_enable_cpuslocked+0x99/0xb0
> > 09:44:17 [ 0.000000] ? report_bug+0x193/0x1a0
> > 09:44:17 [ 0.000000] ? fixup_exception+0x2b/0x340
> > 09:44:17 [ 0.000000] ? early_fixup_exception+0xa6/0xd0
> > 09:44:17 [ 0.000000] ? do_early_exception+0x27/0x70
> > 09:44:17 [ 0.000000] ? early_idt_handler_common+0x2f/0x3a
> > 09:44:17 [ 0.000000] ? static_key_enable_cpuslocked+0x99/0xb0
> > 09:44:17 [ 0.000000] static_key_enable+0x1f/0x30
> > 09:44:17 [ 0.000000] security_add_hooks+0xce/0x150
> > 09:44:17 [ 0.000000] lockdown_lsm_init+0x25/0x30
> > 09:44:17 [ 0.000000] initialize_lsm+0x38/0x90
> > 09:44:17 [ 0.000000] early_security_init+0x36/0x70
> > 09:44:17 [ 0.000000] start_kernel+0x5f/0xb50
> > 09:44:17 [ 0.000000] x86_64_start_reservations+0x1c/0x30
> > 09:44:17 [ 0.000000] x86_64_start_kernel+0xbf/0x110
> > 09:44:17 [ 0.000000] ? setup_ghcb+0x12/0x130
> > 09:44:17 [ 0.000000] common_startup_64+0x13e/0x141
> > 09:44:17 [ 0.000000] </TASK>
> > 09:44:17 [ 0.000000] ---[ end trace 0000000000000000 ]---
>
> KP, please take a look at this as soon as you can (lore link below for
> those who aren't on the list). One obvious first thing to look at is
> simply moving the call to early_security_init(), but that requires
> some code audit to make sure it is safe and doesn't break something
> else. Of course, if we can do something with how we setup/use static
> calls that is even better. I'll take a look at it myself later today,
> but I'm busy with meetings for the next several hours.
>
> If we can't resolve this in the next day or two I'm going to
Thanks for the ping.
Taking a look, yeah it's possible that we need to move jump_label_init
before early_security_init / inside it.
I will do a repro and test my change and reply back.
- KP
> bounce/revert the LSM static-call patchset from lsm/dev; not ideal,
> but we can't break linux-next.
>
> https://lore.kernel.org/linux-security-module/20240730113419.GBZqjPu6SdAt5qZKnh@fat_crate.local/
>
> --
> paul-moore.com
^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: static_key_enable_cpuslocked(): static key 'security_hook_active_locked_down_0+0x0/0x10' used before call to jump_label_init()
2024-07-30 17:40 ` KP Singh
@ 2024-07-30 20:36 ` Paul Moore
2024-07-31 21:32 ` Paul Moore
0 siblings, 1 reply; 8+ messages in thread
From: Paul Moore @ 2024-07-30 20:36 UTC (permalink / raw)
To: KP Singh
Cc: linux-security-module, James Morris, Serge E. Hallyn,
Narasimhan V, lkml, Borislav Petkov
On Tue, Jul 30, 2024 at 1:40 PM KP Singh <kpsingh@kernel.org> wrote:
> On Tue, Jul 30, 2024 at 5:03 PM Paul Moore <paul@paul-moore.com> wrote:
> > On Tue, Jul 30, 2024 at 7:34 AM Borislav Petkov <bp@alien8.de> wrote:
> > >
> > > Hi,
> > >
> > > this is with today's linux-next:
> > >
> > > ...
> > >
> > > 09:44:13 [console-expect]#kexec -e
> > > 09:44:13 kexec -e
> > > 09:44:16 ^[[?2004l^M[ 0.000000] Linux version 6.11.0-rc1-next-20240730-1722324631886 (gcc (Ubuntu 11.4.0-1ubuntu1~22.04) 11.4.0, GNU ld (GNU Binutils for Ubuntu) 2.38) #1 SMP PREEMPT_DYNAMIC Tue Jul 30 07:40:55 UTC 2024
> > > 09:44:16 [ 0.000000] ------------[ cut here ]------------
> > > 09:44:16 [ 0.000000] WARNING: CPU: 0 PID: 0 at kernel/static_call_inline.c:153 __static_call_update+0x1c6/0x220
...
> > KP, please take a look at this as soon as you can (lore link below for
> > those who aren't on the list). One obvious first thing to look at is
> > simply moving the call to early_security_init(), but that requires
> > some code audit to make sure it is safe and doesn't break something
> > else. Of course, if we can do something with how we setup/use static
> > calls that is even better. I'll take a look at it myself later today,
> > but I'm busy with meetings for the next several hours.
> >
> > If we can't resolve this in the next day or two I'm going to
>
> Thanks for the ping.
>
> Taking a look, yeah it's possible that we need to move jump_label_init
> before early_security_init / inside it.
>
> I will do a repro and test my change and reply back.
I'm pretty sure we don't want to move jump_label_init() inside
early_security_init(), we likely want to keep those as distinct calls
in start_kernel(). Shuffling the ordering around seems like a better
solution if we can't solve this some other way.
Regardless, thanks for looking into this, I'll hold off on digging
into this and wait for your patch.
--
paul-moore.com
^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: static_key_enable_cpuslocked(): static key 'security_hook_active_locked_down_0+0x0/0x10' used before call to jump_label_init()
2024-07-30 20:36 ` Paul Moore
@ 2024-07-31 21:32 ` Paul Moore
2024-07-31 22:33 ` KP Singh
0 siblings, 1 reply; 8+ messages in thread
From: Paul Moore @ 2024-07-31 21:32 UTC (permalink / raw)
To: KP Singh
Cc: linux-security-module, James Morris, Serge E. Hallyn,
Narasimhan V, lkml, Borislav Petkov
On Tue, Jul 30, 2024 at 4:36 PM Paul Moore <paul@paul-moore.com> wrote:
> On Tue, Jul 30, 2024 at 1:40 PM KP Singh <kpsingh@kernel.org> wrote:
> > On Tue, Jul 30, 2024 at 5:03 PM Paul Moore <paul@paul-moore.com> wrote:
> > > On Tue, Jul 30, 2024 at 7:34 AM Borislav Petkov <bp@alien8.de> wrote:
> > > >
> > > > Hi,
> > > >
> > > > this is with today's linux-next:
> > > >
> > > > ...
> > > >
> > > > 09:44:13 [console-expect]#kexec -e
> > > > 09:44:13 kexec -e
> > > > 09:44:16 ^[[?2004l^M[ 0.000000] Linux version 6.11.0-rc1-next-20240730-1722324631886 (gcc (Ubuntu 11.4.0-1ubuntu1~22.04) 11.4.0, GNU ld (GNU Binutils for Ubuntu) 2.38) #1 SMP PREEMPT_DYNAMIC Tue Jul 30 07:40:55 UTC 2024
> > > > 09:44:16 [ 0.000000] ------------[ cut here ]------------
> > > > 09:44:16 [ 0.000000] WARNING: CPU: 0 PID: 0 at kernel/static_call_inline.c:153 __static_call_update+0x1c6/0x220
>
> ...
>
> > > KP, please take a look at this as soon as you can (lore link below for
> > > those who aren't on the list). One obvious first thing to look at is
> > > simply moving the call to early_security_init(), but that requires
> > > some code audit to make sure it is safe and doesn't break something
> > > else. Of course, if we can do something with how we setup/use static
> > > calls that is even better. I'll take a look at it myself later today,
> > > but I'm busy with meetings for the next several hours.
> > >
> > > If we can't resolve this in the next day or two I'm going to
> >
> > Thanks for the ping.
> >
> > Taking a look, yeah it's possible that we need to move jump_label_init
> > before early_security_init / inside it.
> >
> > I will do a repro and test my change and reply back.
>
> I'm pretty sure we don't want to move jump_label_init() inside
> early_security_init(), we likely want to keep those as distinct calls
> in start_kernel(). Shuffling the ordering around seems like a better
> solution if we can't solve this some other way.
>
> Regardless, thanks for looking into this, I'll hold off on digging
> into this and wait for your patch.
Since I don't want to leave linux-next broken any longer, I'm going to
yank the static-call patches from the lsm/next branch but I'll leave
them in lsm/dev so you can continue to use that as a basis for your
fix. If we don't have a fix in hand by the first half of next week,
I'll drop the patches from lsm/dev too and we can revisit the patchset
when you have a fix ready.
For casual observers, the lsm/next is normally an automatically
composed branch made up of the latest lsm/stable-X.Y and lsm/dev
branches however in this particular case I'm going to manually update
the lsm/next branch. The normal process is described here:
* https://github.com/LinuxSecurityModule/kernel/blob/main/README.md
--
paul-moore.com
^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: static_key_enable_cpuslocked(): static key 'security_hook_active_locked_down_0+0x0/0x10' used before call to jump_label_init()
2024-07-31 21:32 ` Paul Moore
@ 2024-07-31 22:33 ` KP Singh
2024-08-01 1:13 ` Paul Moore
0 siblings, 1 reply; 8+ messages in thread
From: KP Singh @ 2024-07-31 22:33 UTC (permalink / raw)
To: Paul Moore
Cc: linux-security-module, James Morris, Serge E. Hallyn,
Narasimhan V, lkml, Borislav Petkov
On Wed, Jul 31, 2024 at 11:33 PM Paul Moore <paul@paul-moore.com> wrote:
>
> On Tue, Jul 30, 2024 at 4:36 PM Paul Moore <paul@paul-moore.com> wrote:
> > On Tue, Jul 30, 2024 at 1:40 PM KP Singh <kpsingh@kernel.org> wrote:
> > > On Tue, Jul 30, 2024 at 5:03 PM Paul Moore <paul@paul-moore.com> wrote:
> > > > On Tue, Jul 30, 2024 at 7:34 AM Borislav Petkov <bp@alien8.de> wrote:
> > > > >
> > > > > Hi,
> > > > >
> > > > > this is with today's linux-next:
> > > > >
> > > > > ...
> > > > >
> > > > > 09:44:13 [console-expect]#kexec -e
> > > > > 09:44:13 kexec -e
> > > > > 09:44:16 ^[[?2004l^M[ 0.000000] Linux version 6.11.0-rc1-next-20240730-1722324631886 (gcc (Ubuntu 11.4.0-1ubuntu1~22.04) 11.4.0, GNU ld (GNU Binutils for Ubuntu) 2.38) #1 SMP PREEMPT_DYNAMIC Tue Jul 30 07:40:55 UTC 2024
> > > > > 09:44:16 [ 0.000000] ------------[ cut here ]------------
> > > > > 09:44:16 [ 0.000000] WARNING: CPU: 0 PID: 0 at kernel/static_call_inline.c:153 __static_call_update+0x1c6/0x220
> >
> > ...
> >
> > > > KP, please take a look at this as soon as you can (lore link below for
> > > > those who aren't on the list). One obvious first thing to look at is
> > > > simply moving the call to early_security_init(), but that requires
> > > > some code audit to make sure it is safe and doesn't break something
> > > > else. Of course, if we can do something with how we setup/use static
> > > > calls that is even better. I'll take a look at it myself later today,
> > > > but I'm busy with meetings for the next several hours.
> > > >
> > > > If we can't resolve this in the next day or two I'm going to
> > >
> > > Thanks for the ping.
> > >
> > > Taking a look, yeah it's possible that we need to move jump_label_init
> > > before early_security_init / inside it.
> > >
> > > I will do a repro and test my change and reply back.
> >
> > I'm pretty sure we don't want to move jump_label_init() inside
> > early_security_init(), we likely want to keep those as distinct calls
> > in start_kernel(). Shuffling the ordering around seems like a better
> > solution if we can't solve this some other way.
> >
> > Regardless, thanks for looking into this, I'll hold off on digging
> > into this and wait for your patch.
>
> Since I don't want to leave linux-next broken any longer, I'm going to
> yank the static-call patches from the lsm/next branch but I'll leave
> them in lsm/dev so you can continue to use that as a basis for your
> fix. If we don't have a fix in hand by the first half of next week,
> I'll drop the patches from lsm/dev too and we can revisit the patchset
> when you have a fix ready.
>
> For casual observers, the lsm/next is normally an automatically
> composed branch made up of the latest lsm/stable-X.Y and lsm/dev
> branches however in this particular case I'm going to manually update
> the lsm/next branch. The normal process is described here:
>
> * https://github.com/LinuxSecurityModule/kernel/blob/main/README.md
>
I sent this a couple of minutes after you sent the email. I was trying
to reproduce / confirm the original issue before posting the patch.
https://lore.kernel.org/linux-security-module/20240731213429.2244234-1-kpsingh@kernel.org/T/#u
> --
> paul-moore.com
^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: static_key_enable_cpuslocked(): static key 'security_hook_active_locked_down_0+0x0/0x10' used before call to jump_label_init()
2024-07-31 22:33 ` KP Singh
@ 2024-08-01 1:13 ` Paul Moore
0 siblings, 0 replies; 8+ messages in thread
From: Paul Moore @ 2024-08-01 1:13 UTC (permalink / raw)
To: KP Singh
Cc: linux-security-module, James Morris, Serge E. Hallyn,
Narasimhan V, lkml, Borislav Petkov
On Wed, Jul 31, 2024 at 6:33 PM KP Singh <kpsingh@kernel.org> wrote:
> On Wed, Jul 31, 2024 at 11:33 PM Paul Moore <paul@paul-moore.com> wrote:
> > On Tue, Jul 30, 2024 at 4:36 PM Paul Moore <paul@paul-moore.com> wrote:
> > > On Tue, Jul 30, 2024 at 1:40 PM KP Singh <kpsingh@kernel.org> wrote:
> > > > On Tue, Jul 30, 2024 at 5:03 PM Paul Moore <paul@paul-moore.com> wrote:
> > > > > On Tue, Jul 30, 2024 at 7:34 AM Borislav Petkov <bp@alien8.de> wrote:
> > > > > >
> > > > > > Hi,
> > > > > >
> > > > > > this is with today's linux-next:
> > > > > >
> > > > > > ...
> > > > > >
> > > > > > 09:44:13 [console-expect]#kexec -e
> > > > > > 09:44:13 kexec -e
> > > > > > 09:44:16 ^[[?2004l^M[ 0.000000] Linux version 6.11.0-rc1-next-20240730-1722324631886 (gcc (Ubuntu 11.4.0-1ubuntu1~22.04) 11.4.0, GNU ld (GNU Binutils for Ubuntu) 2.38) #1 SMP PREEMPT_DYNAMIC Tue Jul 30 07:40:55 UTC 2024
> > > > > > 09:44:16 [ 0.000000] ------------[ cut here ]------------
> > > > > > 09:44:16 [ 0.000000] WARNING: CPU: 0 PID: 0 at kernel/static_call_inline.c:153 __static_call_update+0x1c6/0x220
> > >
> > > ...
> > >
> > > > > KP, please take a look at this as soon as you can (lore link below for
> > > > > those who aren't on the list). One obvious first thing to look at is
> > > > > simply moving the call to early_security_init(), but that requires
> > > > > some code audit to make sure it is safe and doesn't break something
> > > > > else. Of course, if we can do something with how we setup/use static
> > > > > calls that is even better. I'll take a look at it myself later today,
> > > > > but I'm busy with meetings for the next several hours.
> > > > >
> > > > > If we can't resolve this in the next day or two I'm going to
> > > >
> > > > Thanks for the ping.
> > > >
> > > > Taking a look, yeah it's possible that we need to move jump_label_init
> > > > before early_security_init / inside it.
> > > >
> > > > I will do a repro and test my change and reply back.
> > >
> > > I'm pretty sure we don't want to move jump_label_init() inside
> > > early_security_init(), we likely want to keep those as distinct calls
> > > in start_kernel(). Shuffling the ordering around seems like a better
> > > solution if we can't solve this some other way.
> > >
> > > Regardless, thanks for looking into this, I'll hold off on digging
> > > into this and wait for your patch.
> >
> > Since I don't want to leave linux-next broken any longer, I'm going to
> > yank the static-call patches from the lsm/next branch but I'll leave
> > them in lsm/dev so you can continue to use that as a basis for your
> > fix. If we don't have a fix in hand by the first half of next week,
> > I'll drop the patches from lsm/dev too and we can revisit the patchset
> > when you have a fix ready.
> >
> > For casual observers, the lsm/next is normally an automatically
> > composed branch made up of the latest lsm/stable-X.Y and lsm/dev
> > branches however in this particular case I'm going to manually update
> > the lsm/next branch. The normal process is described here:
> >
> > * https://github.com/LinuxSecurityModule/kernel/blob/main/README.md
>
> I sent this a couple of minutes after you sent the email. I was trying
> to reproduce / confirm the original issue before posting the patch.
Yes, I think our emails must have crossed paths. Regardless, let's
see if we can get some ACKs/Reviews from the static call folks just to
make sure we are doing something silly by moving the init point.
--
paul-moore.com
^ permalink raw reply [flat|nested] 8+ messages in thread
end of thread, other threads:[~2024-08-01 1:13 UTC | newest]
Thread overview: 8+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2024-07-30 11:34 static_key_enable_cpuslocked(): static key 'security_hook_active_locked_down_0+0x0/0x10' used before call to jump_label_init() Borislav Petkov
2024-07-30 13:43 ` Borislav Petkov
2024-07-30 15:02 ` Paul Moore
2024-07-30 17:40 ` KP Singh
2024-07-30 20:36 ` Paul Moore
2024-07-31 21:32 ` Paul Moore
2024-07-31 22:33 ` KP Singh
2024-08-01 1:13 ` Paul Moore
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®