CAN-2005-0204 and 2.4

[Horms <horms@debian.org>]

On Wed, Sep 21, 2005 at 01:31:37PM +0300, Nikos Ntarmos wrote:
> Package: kernel-source-2.4.27
> Version: 2.4.27-11.hls.2005082200
> Severity: important
> Justification: fails to build from source
> 
> Patch 143_outs.diff.bz2 breaks the kernel compilation on x86_64. The
> problem is that it uses the IO_BITMAP_BYTES macro which is defined for
> i386 (in linux/include/asm-i386/processor.h) but not for x86_64.
> Reverting the patch lets the kernel build again, although I guess the
> correct solution would be to add an appropriate IO_BITMAP_BYTES to
> linux/include/asm-x86_64/processor.h as well.

Hi Nikos,

First up, thanks for testing out my prebuild kernels.  For the
uninitiated they are snapshots of what is in the deabian kernel-team's
SVN and live in http://packages.vergenet.net/testing/

The problem that you see is a patch that was included in
2.4.27-11 (the current version in sid), though it isn't built
for amd64.

Could you see if the following patch works for you.  I've CCed lkml and
Marcelo for their consideration.  It seems to me that 2.4 is indeed
vulnerable to CAN-2005-0204, perhaps someone can shed some light on
this.

-- 
Horms

Description: [CAN-2005-0204]: AMD64, allows local users to write to privileged IO ports via OUTS instruction
Patch author: Suresh Siddha (suresh.b.siddha@intel.com)
Upstream status: not applied
URL: https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=146244
Patch source: Micah Anderson <micah@riseup.net> (debian-kernel)

Added definition of IO_BITMAP_BYTES for Debian's 2.4.27 and
submitted upstream for consideration for inclusion in 2.4 -- Horms
 
--- a/include/asm-x86_64/desc.h	2005-02-24 19:51:26.000000000 +0900
+++ b/include/asm-x86_64/desc.h	2005-02-24 19:52:40.000000000 +0900
@@ -128,7 +128,7 @@
 
 static inline void set_tss_desc(unsigned n, void *addr)
 { 
-	set_tssldt_descriptor((void *)&gdt_table + __CPU_DESC_INDEX(n,tss), (unsigned long)addr, DESC_TSS, sizeof(struct tss_struct)); 
+	set_tssldt_descriptor((void *)&gdt_table + __CPU_DESC_INDEX(n,tss), (unsigned long)addr, DESC_TSS, IO_BITMAP_OFFSET + IO_BITMAP_BYTES + 7); 
 } 
 
 static inline void set_ldt_desc(unsigned n, void *addr, int size)
--- a/include/asm-x86_64/processor.h	2005-09-22 11:12:40.000000000 +0900
+++ b/include/asm-x86_64/processor.h	2005-09-22 11:12:43.000000000 +0900
@@ -260,6 +260,7 @@
  * Size of io_bitmap in longwords: 32 is ports 0-0x3ff.
  */
 #define IO_BITMAP_SIZE	32
+#define IO_BITMAP_BYTES (IO_BITMAP_SIZE * sizeof(u32))
 #define IO_BITMAP_OFFSET offsetof(struct tss_struct,io_bitmap)
 #define INVALID_IO_BITMAP_OFFSET 0x8000