]>
Commit | Line | Data |
---|---|---|
59d5af67 | 1 | From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 |
321d628a FG |
2 | From: Thomas Gleixner <tglx@linutronix.de> |
3 | Date: Sat, 23 Dec 2017 19:45:11 +0100 | |
59d5af67 | 4 | Subject: [PATCH] x86/cpu_entry_area: Prevent wraparound in |
321d628a FG |
5 | setup_cpu_entry_area_ptes() on 32bit |
6 | MIME-Version: 1.0 | |
7 | Content-Type: text/plain; charset=UTF-8 | |
8 | Content-Transfer-Encoding: 8bit | |
9 | ||
10 | CVE-2017-5754 | |
11 | ||
12 | The loop which populates the CPU entry area PMDs can wrap around on 32bit | |
13 | machines when the number of CPUs is small. | |
14 | ||
15 | It worked wonderful for NR_CPUS=64 for whatever reason and the moron who | |
16 | wrote that code did not bother to test it with !SMP. | |
17 | ||
18 | Check for the wraparound to fix it. | |
19 | ||
20 | Fixes: 92a0f81d8957 ("x86/cpu_entry_area: Move it out of the fixmap") | |
21 | Reported-by: kernel test robot <fengguang.wu@intel.com> | |
22 | Signed-off-by: Thomas "Feels stupid" Gleixner <tglx@linutronix.de> | |
23 | Tested-by: Borislav Petkov <bp@alien8.de> | |
24 | (cherry picked from commit f6c4fd506cb626e4346aa81688f255e593a7c5a0) | |
25 | Signed-off-by: Andy Whitcroft <apw@canonical.com> | |
26 | Signed-off-by: Kleber Sacilotto de Souza <kleber.souza@canonical.com> | |
27 | (cherry picked from commit 8a21158932b93ed7e72d16683085d55a3a06125e) | |
28 | Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com> | |
29 | --- | |
30 | arch/x86/mm/cpu_entry_area.c | 3 ++- | |
31 | 1 file changed, 2 insertions(+), 1 deletion(-) | |
32 | ||
33 | diff --git a/arch/x86/mm/cpu_entry_area.c b/arch/x86/mm/cpu_entry_area.c | |
34 | index 21e8b595cbb1..fe814fd5e014 100644 | |
35 | --- a/arch/x86/mm/cpu_entry_area.c | |
36 | +++ b/arch/x86/mm/cpu_entry_area.c | |
37 | @@ -122,7 +122,8 @@ static __init void setup_cpu_entry_area_ptes(void) | |
38 | start = CPU_ENTRY_AREA_BASE; | |
39 | end = start + CPU_ENTRY_AREA_MAP_SIZE; | |
40 | ||
41 | - for (; start < end; start += PMD_SIZE) | |
42 | + /* Careful here: start + PMD_SIZE might wrap around */ | |
43 | + for (; start < end && start >= CPU_ENTRY_AREA_BASE; start += PMD_SIZE) | |
44 | populate_extra_pte(start); | |
45 | #endif | |
46 | } | |
47 | -- | |
48 | 2.14.2 | |
49 |