patches/kernel/0186-x86-cpu_entry_area-Prevent-wraparound-in-setup_cpu_e.patch

   1 From 23aa91651cbaf32f10ff75f02c281493ee677dcb Mon Sep 17 00:00:00 2001
   2 From: Thomas Gleixner <tglx@linutronix.de>
   3 Date: Sat, 23 Dec 2017 19:45:11 +0100
   4 Subject: [PATCH 186/233] x86/cpu_entry_area: Prevent wraparound in
   5  setup_cpu_entry_area_ptes() on 32bit
   6 MIME-Version: 1.0
   7 Content-Type: text/plain; charset=UTF-8
   8 Content-Transfer-Encoding: 8bit
   9
  10 CVE-2017-5754
  11
  12 The loop which populates the CPU entry area PMDs can wrap around on 32bit
  13 machines when the number of CPUs is small.
  14
  15 It worked wonderful for NR_CPUS=64 for whatever reason and the moron who
  16 wrote that code did not bother to test it with !SMP.
  17
  18 Check for the wraparound to fix it.
  19
  20 Fixes: 92a0f81d8957 ("x86/cpu_entry_area: Move it out of the fixmap")
  21 Reported-by: kernel test robot <fengguang.wu@intel.com>
  22 Signed-off-by: Thomas "Feels stupid" Gleixner <tglx@linutronix.de>
  23 Tested-by: Borislav Petkov <bp@alien8.de>
  24 (cherry picked from commit f6c4fd506cb626e4346aa81688f255e593a7c5a0)
  25 Signed-off-by: Andy Whitcroft <apw@canonical.com>
  26 Signed-off-by: Kleber Sacilotto de Souza <kleber.souza@canonical.com>
  27 (cherry picked from commit 8a21158932b93ed7e72d16683085d55a3a06125e)
  28 Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
  29 ---
  30  arch/x86/mm/cpu_entry_area.c | 3 ++-
  31  1 file changed, 2 insertions(+), 1 deletion(-)
  32
  33 diff --git a/arch/x86/mm/cpu_entry_area.c b/arch/x86/mm/cpu_entry_area.c
  34 index 21e8b595cbb1..fe814fd5e014 100644
  35 --- a/arch/x86/mm/cpu_entry_area.c
  36 +++ b/arch/x86/mm/cpu_entry_area.c
  37 @@ -122,7 +122,8 @@ static __init void setup_cpu_entry_area_ptes(void)
  38         start = CPU_ENTRY_AREA_BASE;
  39         end = start + CPU_ENTRY_AREA_MAP_SIZE;
  40
  41 -       for (; start < end; start += PMD_SIZE)
  42 +       /* Careful here: start + PMD_SIZE might wrap around */
  43 +       for (; start < end && start >= CPU_ENTRY_AREA_BASE; start += PMD_SIZE)
  44                 populate_extra_pte(start);
  45  #endif
  46  }
  47 --
  48 2.14.2
  49