Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752914AbdL0Qy5 (ORCPT ); Wed, 27 Dec 2017 11:54:57 -0500 Received: from mail.linuxfoundation.org ([140.211.169.12]:37472 "EHLO mail.linuxfoundation.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752925AbdL0Qyw (ORCPT ); Wed, 27 Dec 2017 11:54:52 -0500 From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, kernel test robot , =?UTF-8?q?Thomas=20 Feels=20stupid =20Gleixner?= , Borislav Petkov Subject: [PATCH 4.14 32/74] x86/cpu_entry_area: Prevent wraparound in setup_cpu_entry_area_ptes() on 32bit Date: Wed, 27 Dec 2017 17:46:05 +0100 Message-Id: <20171227164615.375879485@linuxfoundation.org> X-Mailer: git-send-email 2.15.1 In-Reply-To: <20171227164614.109898944@linuxfoundation.org> References: <20171227164614.109898944@linuxfoundation.org> User-Agent: quilt/0.65 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1294 Lines: 39 4.14-stable review patch. If anyone has any objections, please let me know. ------------------ From: Thomas Gleixner commit f6c4fd506cb626e4346aa81688f255e593a7c5a0 upstream. The loop which populates the CPU entry area PMDs can wrap around on 32bit machines when the number of CPUs is small. It worked wonderful for NR_CPUS=64 for whatever reason and the moron who wrote that code did not bother to test it with !SMP. Check for the wraparound to fix it. Fixes: 92a0f81d8957 ("x86/cpu_entry_area: Move it out of the fixmap") Reported-by: kernel test robot Signed-off-by: Thomas "Feels stupid" Gleixner Tested-by: Borislav Petkov Signed-off-by: Greg Kroah-Hartman --- arch/x86/mm/cpu_entry_area.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) --- a/arch/x86/mm/cpu_entry_area.c +++ b/arch/x86/mm/cpu_entry_area.c @@ -122,7 +122,8 @@ static __init void setup_cpu_entry_area_ start = CPU_ENTRY_AREA_BASE; end = start + CPU_ENTRY_AREA_MAP_SIZE; - for (; start < end; start += PMD_SIZE) + /* Careful here: start + PMD_SIZE might wrap around */ + for (; start < end && start >= CPU_ENTRY_AREA_BASE; start += PMD_SIZE) populate_extra_pte(start); #endif }