[PATCH 0/3] arm64: Fix text-poke byte-order and late PLT/veneer ROX handling

[Rui Qi]

This series fixes three bugs in the arm64 text-poke / module relocation
path, all introduced by the recent text-poke rework (451c3cab9a65
"arm64: patching: implement text_poke API" and 91b89a634487
"arm64/module: Use text-poke API for late relocations.").  The first
two are big-endian byte-order issues; the third is a panic when
livepatch emits PLT entries into read-only executable memory.

Patch 1 fixes big-endian breakage in late data relocations.  The
WRITE_PLACE() macro declared its temporary with the type of the source
argument (s64), but aarch64_insn_copy() copies only sizeof(*place)
bytes from the start of that temporary.  On a big-endian kernel the
most significant bytes sit at the lowest address, so a 16- or 32-bit
relocation copies the sign-extension upper half instead of the
computed value.  Typing the temporary after the destination element
fixes this.

Patch 2 fixes big-endian breakage in aarch64_insn_set().  The
instruction is passed to text_poke_memset() in host byte order, but
A64 instructions must be little-endian in memory.  On a big-endian
kernel the written bytes are reversed and the CPU takes an UNDEFINED
instruction exception when fetching them.  This is reachable in-tree:
bpf_arch_text_invalidate() fills freed JIT regions with
AARCH64_BREAK_FAULT through aarch64_insn_set(), and arm64 selects
HAVE_EBPF_JIT without a big-endian guard.  Converting to little-endian
before the memset, mirroring aarch64_insn_write(), fixes this.

Patch 3 (the main fix) routes PLT/veneer emission through the
text-poke API.  module_emit_plt_entry() and module_emit_veneer_for_adrp()
wrote PLT entries into the .plt section by direct assignment, but once
a module is fully formed its .plt is read-only/executable.  A late
(livepatch) relocation that falls back to PLT emission -- an
out-of-range R_AARCH64_CALL26/JUMP26, or an ADRP under
CONFIG_ARM64_ERRATUM_843419 -- triggers a synchronous Data Abort and
panics.  Routing through the text-poke API (mirroring WRITE_PLACE())
maps the page through the fixmap, avoiding the fault.

All three are tagged for stable.

Base-commit: next-20261008

Rui Qi (3):
  arm64/module: Fix big-endian breakage in late data relocations
  arm64: patching: Fix instruction byte order in aarch64_insn_set()
  arm64: module: Use text-poke for late PLT/veneer emission

 arch/arm64/kernel/module-plts.c | 35 ++++++++++++++++++++++++++++++---
 arch/arm64/kernel/module.c      |  2 +-
 arch/arm64/kernel/patching.c    |  4 +++-
 3 files changed, 36 insertions(+), 5 deletions(-)

-- 
2.20.1