[AUTOSEL,4.14,67/67] x86/mm/pti: Add an overflow check to pti_clone_pmds()

Commit Message

Sasha Levin Sept. 7, 2018, 12:38 a.m. UTC

From: Joerg Roedel <[e-mail]>

[ Upstream commit 935232ce28dfabff1171e5a7113b2d865fa9ee63 ]

The addr counter will overflow if the last PMD of the address space is
cloned, resulting in an endless loop.

Check for that and bail out of the loop when it happens.

Signed-off-by: Joerg Roedel <[e-mail]>
Signed-off-by: Thomas Gleixner <[e-mail]>
Tested-by: Pavel Machek <[e-mail]>
Cc: "H . Peter Anvin" <[e-mail]>
Cc: [e-mail]
Cc: Linus Torvalds <[e-mail]>
Cc: Andy Lutomirski <[e-mail]>
Cc: Dave Hansen <[e-mail]>
Cc: Josh Poimboeuf <[e-mail]>
Cc: Juergen Gross <[e-mail]>
Cc: Peter Zijlstra <[e-mail]>
Cc: Borislav Petkov <[e-mail]>
Cc: Jiri Kosina <[e-mail]>
Cc: Boris Ostrovsky <[e-mail]>
Cc: Brian Gerst <[e-mail]>
Cc: David Laight <[e-mail]>
Cc: Denys Vlasenko <[e-mail]>
Cc: Eduardo Valentin <[e-mail]>
Cc: Greg KH <[e-mail]>
Cc: Will Deacon <[e-mail]>
Cc: [e-mail]
Cc: [e-mail]
Cc: [e-mail]
Cc: [e-mail]
Cc: Andrea Arcangeli <[e-mail]>
Cc: Waiman Long <[e-mail]>
Cc: "David H . Gutteridge" <[e-mail]>
Cc: [e-mail]
Link: https://lkml.kernel.org/r/[e-mail]
Signed-off-by: Sasha Levin <[e-mail]>
---
 arch/x86/mm/pti.c | 4 ++++
 1 file changed, 4 insertions(+)

Patch

diff --git a/arch/x86/mm/pti.c b/arch/x86/mm/pti.c
index 7786ab306225..b07e3ffc5ac5 100644
--- a/arch/x86/mm/pti.c
+++ b/arch/x86/mm/pti.c
@@ -291,6 +291,10 @@  pti_clone_pmds(unsigned long start, unsigned long end, pmdval_t clear)
 		p4d_t *p4d;
 		pud_t *pud;
 
+		/* Overflow check */
+		if (addr < start)
+			break;
+
 		pgd = pgd_offset_k(addr);
 		if (WARN_ON(pgd_none(*pgd)))
 			return;