From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail333.us4.mandrillapp.com ([205.201.137.77]:53200 "EHLO mail333.us4.mandrillapp.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752567AbcCAWXZ (ORCPT ); Tue, 1 Mar 2016 17:23:25 -0500 Received: from pmta03.dal05.mailchimp.com (127.0.0.1) by mail333.us4.mandrillapp.com id hqob5q174noa for ; Tue, 1 Mar 2016 22:23:23 +0000 (envelope-from ) From: Subject: Patch "KVM: x86: fix conversion of addresses to linear in 32-bit protected mode" has been added to the 4.4-stable tree To: , , Cc: , Message-Id: <1456870999121141@kroah.com> Date: Tue, 01 Mar 2016 22:23:24 +0000 MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 7bit Sender: stable-owner@vger.kernel.org List-ID: This is a note to let you know that I've just added the patch titled KVM: x86: fix conversion of addresses to linear in 32-bit protected mode to the 4.4-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: kvm-x86-fix-conversion-of-addresses-to-linear-in-32-bit-protected-mode.patch and it can be found in the queue-4.4 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let know about it. >>From 0c1d77f4ba5cc9c05a29adca3d6466cdf4969b70 Mon Sep 17 00:00:00 2001 From: Paolo Bonzini Date: Fri, 19 Feb 2016 18:07:21 +0100 Subject: KVM: x86: fix conversion of addresses to linear in 32-bit protected mode From: Paolo Bonzini commit 0c1d77f4ba5cc9c05a29adca3d6466cdf4969b70 upstream. Commit e8dd2d2d641c ("Silence compiler warning in arch/x86/kvm/emulate.c", 2015-09-06) broke boot of the Hurd. The bug is that the "default:" case actually could modify "la", but after the patch this change is not reflected in *linear. The bug is visible whenever a non-zero segment base causes the linear address to wrap around the 4GB mark. Fixes: e8dd2d2d641cb2724ee10e76c0ad02e04289c017 Reported-by: Aurelien Jarno Tested-by: Aurelien Jarno Signed-off-by: Paolo Bonzini Signed-off-by: Greg Kroah-Hartman --- arch/x86/kvm/emulate.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) --- a/arch/x86/kvm/emulate.c +++ b/arch/x86/kvm/emulate.c @@ -650,10 +650,10 @@ static __always_inline int __linearize(s u16 sel; la = seg_base(ctxt, addr.seg) + addr.ea; - *linear = la; *max_size = 0; switch (mode) { case X86EMUL_MODE_PROT64: + *linear = la; if (is_noncanonical_address(la)) goto bad; @@ -662,6 +662,7 @@ static __always_inline int __linearize(s goto bad; break; default: + *linear = la = (u32)la; usable = ctxt->ops->get_segment(ctxt, &sel, &desc, NULL, addr.seg); if (!usable) @@ -689,7 +690,6 @@ static __always_inline int __linearize(s if (size > *max_size) goto bad; } - la &= (u32)-1; break; } if (insn_aligned(ctxt, size) && ((la & (size - 1)) != 0)) Patches currently in stable-queue which might be from pbonzini@redhat.com are queue-4.4/kvm-x86-fix-conversion-of-addresses-to-linear-in-32-bit-protected-mode.patch queue-4.4/kvm-x86-mmu-fix-ubsan-index-out-of-range-warning.patch queue-4.4/kvm-x86-fix-missed-hardware-breakpoints.patch queue-4.4/kvm-async_pf-do-not-warn-on-page-allocation-failures.patch