All of lore.kernel.org
 help / color / mirror / Atom feed
From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: "Kirill A. Shutemov" <kirill@shutemov.name>,
	"Kirill A . Shutemov" <kirill.shutemov@linux.intel.com>,
	Borislav Petkov <bp@suse.de>, "H. Peter Anvin" <hpa@zytor.com>,
	Ingo Molnar <mingo@redhat.com>,
	Thomas Gleixner <tglx@linutronix.de>, x86-ml <x86@kernel.org>,
	Sasha Levin <sashal@kernel.org>
Subject: [PATCH AUTOSEL 4.19 31/45] x86/boot/compressed/64: Fix boot on machines with broken E820 table
Date: Thu, 29 Aug 2019 14:15:31 -0400	[thread overview]
Message-ID: <20190829181547.8280-31-sashal@kernel.org> (raw)
In-Reply-To: <20190829181547.8280-1-sashal@kernel.org>

From: "Kirill A. Shutemov" <kirill@shutemov.name>

[ Upstream commit 0a46fff2f9108c2c44218380a43a736cf4612541 ]

BIOS on Samsung 500C Chromebook reports very rudimentary E820 table that
consists of 2 entries:

  BIOS-e820: [mem 0x0000000000000000-0x0000000000000fff] usable
  BIOS-e820: [mem 0x00000000fffff000-0x00000000ffffffff] reserved

It breaks logic in find_trampoline_placement(): bios_start lands on the
end of the first 4k page and trampoline start gets placed below 0.

Detect underflow and don't touch bios_start for such cases. It makes
kernel ignore E820 table on machines that doesn't have two usable pages
below BIOS_START_MAX.

Fixes: 1b3a62643660 ("x86/boot/compressed/64: Validate trampoline placement against E820")
Signed-off-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
Signed-off-by: Borislav Petkov <bp@suse.de>
Cc: "H. Peter Anvin" <hpa@zytor.com>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: x86-ml <x86@kernel.org>
Link: https://bugzilla.kernel.org/show_bug.cgi?id=203463
Link: https://lkml.kernel.org/r/20190813131654.24378-1-kirill.shutemov@linux.intel.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/x86/boot/compressed/pgtable_64.c | 13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

diff --git a/arch/x86/boot/compressed/pgtable_64.c b/arch/x86/boot/compressed/pgtable_64.c
index f8debf7aeb4c1..f0537a1f7fc25 100644
--- a/arch/x86/boot/compressed/pgtable_64.c
+++ b/arch/x86/boot/compressed/pgtable_64.c
@@ -73,6 +73,8 @@ static unsigned long find_trampoline_placement(void)
 
 	/* Find the first usable memory region under bios_start. */
 	for (i = boot_params->e820_entries - 1; i >= 0; i--) {
+		unsigned long new;
+
 		entry = &boot_params->e820_table[i];
 
 		/* Skip all entries above bios_start. */
@@ -85,15 +87,20 @@ static unsigned long find_trampoline_placement(void)
 
 		/* Adjust bios_start to the end of the entry if needed. */
 		if (bios_start > entry->addr + entry->size)
-			bios_start = entry->addr + entry->size;
+			new = entry->addr + entry->size;
 
 		/* Keep bios_start page-aligned. */
-		bios_start = round_down(bios_start, PAGE_SIZE);
+		new = round_down(new, PAGE_SIZE);
 
 		/* Skip the entry if it's too small. */
-		if (bios_start - TRAMPOLINE_32BIT_SIZE < entry->addr)
+		if (new - TRAMPOLINE_32BIT_SIZE < entry->addr)
 			continue;
 
+		/* Protect against underflow. */
+		if (new - TRAMPOLINE_32BIT_SIZE > bios_start)
+			break;
+
+		bios_start = new;
 		break;
 	}
 
-- 
2.20.1


  parent reply	other threads:[~2019-08-29 18:16 UTC|newest]

Thread overview: 52+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2019-08-29 18:15 [PATCH AUTOSEL 4.19 01/45] net: tundra: tsi108: use spin_lock_irqsave instead of spin_lock_irq in IRQ context Sasha Levin
2019-08-29 18:15 ` [PATCH AUTOSEL 4.19 02/45] netfilter: nf_tables: use-after-free in failing rule with bound set Sasha Levin
2019-08-29 18:15 ` [PATCH AUTOSEL 4.19 03/45] rxrpc: Fix local endpoint refcounting Sasha Levin
2019-08-29 18:15 ` [PATCH AUTOSEL 4.19 04/45] tools: bpftool: fix error message (prog -> object) Sasha Levin
2019-08-29 18:15 ` [PATCH AUTOSEL 4.19 05/45] hv_netvsc: Fix a warning of suspicious RCU usage Sasha Levin
2019-08-29 18:15 ` [PATCH AUTOSEL 4.19 06/45] net: tc35815: Explicitly check NET_IP_ALIGN is not zero in tc35815_rx Sasha Levin
2019-08-29 18:15 ` [PATCH AUTOSEL 4.19 07/45] Bluetooth: btqca: Add a short delay before downloading the NVM Sasha Levin
2019-08-29 18:15 ` [PATCH AUTOSEL 4.19 08/45] Bluetooth: hidp: Let hidp_send_message return number of queued bytes Sasha Levin
2019-08-29 18:15 ` [PATCH AUTOSEL 4.19 09/45] ibmveth: Convert multicast list size for little-endian system Sasha Levin
2019-08-29 18:15   ` Sasha Levin
2019-08-29 18:15 ` [PATCH AUTOSEL 4.19 10/45] gpio: Fix build error of function redefinition Sasha Levin
2019-08-29 18:15 ` [PATCH AUTOSEL 4.19 11/45] netfilter: nft_flow_offload: skip tcp rst and fin packets Sasha Levin
2019-08-29 18:15 ` [PATCH AUTOSEL 4.19 12/45] rxrpc: Fix local endpoint replacement Sasha Levin
2019-08-29 18:15 ` [PATCH AUTOSEL 4.19 13/45] rxrpc: Fix read-after-free in rxrpc_queue_local() Sasha Levin
2019-08-29 18:15 ` [PATCH AUTOSEL 4.19 14/45] drm/mediatek: use correct device to import PRIME buffers Sasha Levin
2019-08-29 18:15   ` Sasha Levin
2019-08-29 18:15 ` [PATCH AUTOSEL 4.19 15/45] drm/mediatek: set DMA max segment size Sasha Levin
2019-08-29 18:15   ` Sasha Levin
2019-08-29 18:15 ` [PATCH AUTOSEL 4.19 16/45] scsi: qla2xxx: Fix gnl.l memory leak on adapter init failure Sasha Levin
2019-08-29 18:15 ` [PATCH AUTOSEL 4.19 17/45] scsi: target: tcmu: avoid use-after-free after command timeout Sasha Levin
2019-08-29 18:15   ` Sasha Levin
2019-08-29 18:15 ` [PATCH AUTOSEL 4.19 18/45] cxgb4: fix a memory leak bug Sasha Levin
2019-08-29 18:15 ` [PATCH AUTOSEL 4.19 19/45] liquidio: add cleanup in octeon_setup_iq() Sasha Levin
2019-08-29 18:15 ` [PATCH AUTOSEL 4.19 20/45] net: myri10ge: fix memory leaks Sasha Levin
2019-08-29 18:15 ` [PATCH AUTOSEL 4.19 21/45] lan78xx: Fix " Sasha Levin
2019-08-29 18:15 ` [PATCH AUTOSEL 4.19 22/45] vfs: fix page locking deadlocks when deduping files Sasha Levin
2019-08-29 18:15 ` [PATCH AUTOSEL 4.19 23/45] cx82310_eth: fix a memory leak bug Sasha Levin
2019-08-29 18:15 ` [PATCH AUTOSEL 4.19 24/45] net: kalmia: fix memory leaks Sasha Levin
2019-08-29 18:15 ` [PATCH AUTOSEL 4.19 25/45] ibmvnic: Unmap DMA address of TX descriptor buffers after use Sasha Levin
2019-08-29 18:15   ` Sasha Levin
2019-08-29 18:15 ` [PATCH AUTOSEL 4.19 26/45] net: cavium: fix driver name Sasha Levin
2019-08-29 18:15 ` [PATCH AUTOSEL 4.19 27/45] wimax/i2400m: fix a memory leak bug Sasha Levin
2019-08-29 18:15 ` [PATCH AUTOSEL 4.19 28/45] ravb: Fix use-after-free ravb_tstamp_skb Sasha Levin
2019-08-29 18:15 ` [PATCH AUTOSEL 4.19 29/45] kprobes: Fix potential deadlock in kprobe_optimizer() Sasha Levin
2019-08-29 18:15 ` [PATCH AUTOSEL 4.19 30/45] HID: cp2112: prevent sleeping function called from invalid context Sasha Levin
2019-08-29 18:15 ` Sasha Levin [this message]
2019-08-29 18:15 ` [PATCH AUTOSEL 4.19 32/45] Input: hyperv-keyboard: Use in-place iterator API in the channel callback Sasha Levin
2019-08-29 18:15 ` [PATCH AUTOSEL 4.19 33/45] Tools: hv: kvp: eliminate 'may be used uninitialized' warning Sasha Levin
2019-08-29 18:15 ` [PATCH AUTOSEL 4.19 34/45] nvme-multipath: fix possible I/O hang when paths are updated Sasha Levin
2019-08-29 18:15 ` [PATCH AUTOSEL 4.19 35/45] IB/mlx4: Fix memory leaks Sasha Levin
2019-08-29 18:15 ` [PATCH AUTOSEL 4.19 36/45] infiniband: hfi1: fix a memory leak bug Sasha Levin
2019-08-29 18:15 ` [PATCH AUTOSEL 4.19 37/45] infiniband: hfi1: fix memory leaks Sasha Levin
2019-08-29 18:15 ` [PATCH AUTOSEL 4.19 38/45] selftests: kvm: fix state save/load on processors without XSAVE Sasha Levin
2019-08-29 18:15 ` [PATCH AUTOSEL 4.19 39/45] selftests/kvm: make platform_info_test pass on AMD Sasha Levin
2019-08-29 18:15 ` [PATCH AUTOSEL 4.19 40/45] ceph: fix buffer free while holding i_ceph_lock in __ceph_setxattr() Sasha Levin
2019-08-29 18:15 ` [PATCH AUTOSEL 4.19 41/45] ceph: fix buffer free while holding i_ceph_lock in __ceph_build_xattrs_blob() Sasha Levin
2019-08-29 18:15 ` [PATCH AUTOSEL 4.19 42/45] ceph: fix buffer free while holding i_ceph_lock in fill_inode() Sasha Levin
2019-08-29 18:15 ` [PATCH AUTOSEL 4.19 43/45] KVM: arm/arm64: Only skip MMIO insn once Sasha Levin
2019-08-29 18:15   ` Sasha Levin
2019-08-29 18:15 ` [PATCH AUTOSEL 4.19 44/45] afs: Fix leak in afs_lookup_cell_rcu() Sasha Levin
2019-08-29 18:15 ` [PATCH AUTOSEL 4.19 45/45] KVM: arm/arm64: VGIC: Properly initialise private IRQ affinity Sasha Levin
2019-08-29 18:15   ` Sasha Levin

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20190829181547.8280-31-sashal@kernel.org \
    --to=sashal@kernel.org \
    --cc=bp@suse.de \
    --cc=hpa@zytor.com \
    --cc=kirill.shutemov@linux.intel.com \
    --cc=kirill@shutemov.name \
    --cc=linux-kernel@vger.kernel.org \
    --cc=mingo@redhat.com \
    --cc=stable@vger.kernel.org \
    --cc=tglx@linutronix.de \
    --cc=x86@kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.