[PATCH 1/3] arm64/module: Fix big-endian breakage in late data relocations

[Rui Qi]

The WRITE_PLACE macro declares its temporary value with the type of the
source argument:

    __typeof__(val) __val = (val);

For the 16-bit and 32-bit data relocations in reloc_data(), val is the
s64 result of do_reloc(), so __val is an 8-byte integer.  When the
module is already loaded (state != MODULE_STATE_UNFORMED), the macro
hands the address of __val to aarch64_insn_copy() and asks it to copy
only sizeof(*place) -- 2 or 4 -- bytes.

aarch64_insn_copy() performs a raw byte copy with no endian conversion.
On a big-endian kernel the most significant bytes of the s64 sit at the
lowest address, so copying only the first 2/4 bytes grabs the
sign-extension upper half instead of the computed relocation value,
corrupting the patched location.  The UNFORMED direct-assignment path
is unaffected because the compiler narrows the s64 to the destination
type.

Type the temporary after the destination element instead.

Fixes: 91b89a634487d5614e51ee773a889ed57f5551ca ("arm64/module: Use text-poke API for late relocations.")
Cc: stable at vger.kernel.org
Signed-off-by: Rui Qi <qirui.001 at bytedance.com>
---
 arch/arm64/kernel/module.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm64/kernel/module.c b/arch/arm64/kernel/module.c
index 24adb581af0e..0fdf4c1c4e05 100644
--- a/arch/arm64/kernel/module.c
+++ b/arch/arm64/kernel/module.c
@@ -50,7 +50,7 @@ static u64 do_reloc(enum aarch64_reloc_op reloc_op, __le32 *place, u64 val)
 }
 
 #define WRITE_PLACE(place, val, mod) do {				\
-	__typeof__(val) __val = (val);					\
+	__typeof__(*place) __val = (val);					\
 									\
 	if (mod->state == MODULE_STATE_UNFORMED)			\
 		*(place) = __val;					\
-- 
2.20.1