From 9eec5dbb82babde55ccb76b3d831cb4c01acf171 Mon Sep 17 00:00:00 2001 From: Rong Tao Date: Tue, 23 Dec 2025 10:42:59 +0800 Subject: [PATCH] grub_dl_load_segments(): page-align the tramp/GOT areas. The patch is from upstream: commit 862f81b5b007 ("grub_dl_load_segments(): page-align the tramp/GOT areas too") The tramp/GOT write-protection in grub_dl_set_mem_attrs() requires that the tramp/GOT areas of the module image *not* share a page with any other memory allocations. Page-align the tramp/GOT areas, while satisfying their intrinsic alignment requirements too. ===== We have a different panic stack, but almost the same reason. Our Panic call stack: grub_main grub_load_modules grub_dl_load_core grub_boot_time *BOOM* void grub_real_boot_time (const char *file, const int line, const char *fmt, ...) { struct grub_boot_time *n; va_list args; grub_error_push (); n = grub_malloc (sizeof (*n)); if (!n) { grub_errno = 0; grub_error_pop (); return; } n->file = file; n->line = line; n->tp = grub_get_time_ms (); n->next = 0; va_start (args, fmt); n->msg = grub_xvasprintf (fmt, args); grub_dprintf ("boot", "%s\n", n->msg); va_end (args); *boot_time_last = n; <------ The global ptr has no write-permission boot_time_last = &n->next; grub_errno = 0; grub_error_pop (); Ached-by: Ge Changzhong Signed-off-by: Peijie Shao Committer-by: Rong Tao --- ...ments-page-align-the-tramp-GOT-areas.patch | 123 ++++++++++++++++++ SOURCES/grub.patches | 1 + SPECS/grub2.spec | 5 +- 3 files changed, 128 insertions(+), 1 deletion(-) create mode 100644 SOURCES/0679-grub_dl_load_segments-page-align-the-tramp-GOT-areas.patch diff --git a/SOURCES/0679-grub_dl_load_segments-page-align-the-tramp-GOT-areas.patch b/SOURCES/0679-grub_dl_load_segments-page-align-the-tramp-GOT-areas.patch new file mode 100644 index 0000000..b78e933 --- /dev/null +++ b/SOURCES/0679-grub_dl_load_segments-page-align-the-tramp-GOT-areas.patch @@ -0,0 +1,123 @@ +From f2d5b552f7fa36a8862aba69576c95d81a2a443a Mon Sep 17 00:00:00 2001 +From: Peijie Shao +Date: Sun, 21 Dec 2025 04:12:38 +0800 +Subject: [PATCH] grub_dl_load_segments(): page-align the tramp/GOT areas. + +The patch is from upstream: + commit 862f81b5b007 ("grub_dl_load_segments(): page-align the tramp/GOT areas too") + +The tramp/GOT write-protection in grub_dl_set_mem_attrs() requires that +the tramp/GOT areas of the module image *not* share a page with any other +memory allocations. Page-align the tramp/GOT areas, while satisfying their +intrinsic alignment requirements too. + +===== + +We have a different panic stack, but almost the same reason. +Our Panic call stack: + grub_main + grub_load_modules + grub_dl_load_core + grub_boot_time *BOOM* + +void +grub_real_boot_time (const char *file, + const int line, + const char *fmt, ...) +{ + struct grub_boot_time *n; + va_list args; + + grub_error_push (); + n = grub_malloc (sizeof (*n)); + if (!n) + { + grub_errno = 0; + grub_error_pop (); + return; + } + n->file = file; + n->line = line; + n->tp = grub_get_time_ms (); + n->next = 0; + + va_start (args, fmt); + n->msg = grub_xvasprintf (fmt, args); + grub_dprintf ("boot", "%s\n", n->msg); + va_end (args); + + *boot_time_last = n; <------ The global ptr has no write-permission + boot_time_last = &n->next; + + grub_errno = 0; + grub_error_pop (); +} + +Because dl load module changes the attrs of the page which +boot_time_lasts stays. + +Signed-off-by: Peijie Shao +--- + grub-core/kern/dl.c | 28 ++++++++++++++++++++-------- + 1 file changed, 20 insertions(+), 8 deletions(-) + +diff --git a/grub-core/kern/dl.c b/grub-core/kern/dl.c +index 68d3177..d751543 100644 +--- a/grub-core/kern/dl.c ++++ b/grub-core/kern/dl.c +@@ -281,7 +281,9 @@ grub_dl_load_segments (grub_dl_t mod, const Elf_Ehdr *e) + grub_size_t tsize = 0, talign = 1, arch_addralign = 1; + #if !defined (__i386__) && !defined (__x86_64__) + grub_size_t tramp; ++ grub_size_t tramp_align; + grub_size_t got; ++ grub_size_t got_align; + grub_err_t err; + #endif + char *ptr; +@@ -312,12 +314,22 @@ grub_dl_load_segments (grub_dl_t mod, const Elf_Ehdr *e) + err = grub_arch_dl_get_tramp_got_size (e, &tramp, &got); + if (err) + return err; +- tsize += ALIGN_UP (tramp, GRUB_ARCH_DL_TRAMP_ALIGN); +- if (talign < GRUB_ARCH_DL_TRAMP_ALIGN) +- talign = GRUB_ARCH_DL_TRAMP_ALIGN; +- tsize += ALIGN_UP (got, GRUB_ARCH_DL_GOT_ALIGN); +- if (talign < GRUB_ARCH_DL_GOT_ALIGN) +- talign = GRUB_ARCH_DL_GOT_ALIGN; ++ ++ tramp_align = GRUB_ARCH_DL_TRAMP_ALIGN; ++ if (tramp_align < arch_addralign) ++ tramp_align = arch_addralign; ++ ++ tsize += ALIGN_UP (tramp, tramp_align); ++ if (talign < tramp_align) ++ talign = tramp_align; ++ ++ got_align = GRUB_ARCH_DL_GOT_ALIGN; ++ if (got_align < arch_addralign) ++ got_align = arch_addralign; ++ ++ tsize += ALIGN_UP (got, got_align); ++ if (talign < got_align) ++ talign = got_align; + #endif + + #ifdef GRUB_MACHINE_EMU +@@ -377,11 +389,11 @@ grub_dl_load_segments (grub_dl_t mod, const Elf_Ehdr *e) + } + } + #if !defined (__i386__) && !defined (__x86_64__) +- ptr = (char *) ALIGN_UP ((grub_addr_t) ptr, GRUB_ARCH_DL_TRAMP_ALIGN); ++ ptr = (char *) ALIGN_UP ((grub_addr_t) ptr, tramp_align); + mod->tramp = ptr; + mod->trampptr = ptr; + ptr += tramp; +- ptr = (char *) ALIGN_UP ((grub_addr_t) ptr, GRUB_ARCH_DL_GOT_ALIGN); ++ ptr = (char *) ALIGN_UP ((grub_addr_t) ptr, got_align); + mod->got = ptr; + mod->gotptr = ptr; + ptr += got; +-- +2.43.5 + diff --git a/SOURCES/grub.patches b/SOURCES/grub.patches index 410a31d..f781ee5 100644 --- a/SOURCES/grub.patches +++ b/SOURCES/grub.patches @@ -678,3 +678,4 @@ Patch0675: 0675-fs-xfs-Handle-non-continuous-data-blocks-in-director.patch Patch0676: 0676-fs-xfs-fix-large-extent-counters-incompat-feature-su.patch Patch0677: 0677-fs-ext2-Rework-out-of-bounds-read-for-inline-and-ext.patch Patch0678: 0678-Strip-correctly-BLS-files-with-conf-extension.patch +Patch0679: 0679-grub_dl_load_segments-page-align-the-tramp-GOT-areas.patch diff --git a/SPECS/grub2.spec b/SPECS/grub2.spec index ead67a2..756eae5 100644 --- a/SPECS/grub2.spec +++ b/SPECS/grub2.spec @@ -7,7 +7,7 @@ Name: grub2 Epoch: 1 Version: 2.02 -Release: 169%{?dist}.ap.1 +Release: 170%{?dist} Summary: Bootloader with support for Linux, Multiboot and more Group: System Environment/Base License: GPLv3+ @@ -528,6 +528,9 @@ fi %endif %changelog +* Fri Dec 19 2025 CESTC OS - 2.02-170 +- Fix Synchronous Exception on KP920 5258F machines. + * Thu Oct 09 2025 TencentOS Team - 1:2.02-169.ap.1 - Applied Autopatch for ts3 -- Gitee