From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1762736AbdAEPGy (ORCPT ); Thu, 5 Jan 2017 10:06:54 -0500 Received: from terminus.zytor.com ([198.137.202.10]:43744 "EHLO terminus.zytor.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751482AbdAEPGp (ORCPT ); Thu, 5 Jan 2017 10:06:45 -0500 Date: Thu, 5 Jan 2017 07:04:49 -0800 From: tip-bot for Lukasz Odzioba Message-ID: Cc: peterz@infradead.org, bp@suse.de, tglx@linutronix.de, hpa@zytor.com, torvalds@linux-foundation.org, mingo@kernel.org, linux-kernel@vger.kernel.org, lukasz.odzioba@intel.com Reply-To: mingo@kernel.org, linux-kernel@vger.kernel.org, lukasz.odzioba@intel.com, bp@suse.de, peterz@infradead.org, tglx@linutronix.de, hpa@zytor.com, torvalds@linux-foundation.org In-Reply-To: <1482933340-11857-1-git-send-email-lukasz.odzioba@intel.com> References: <1482933340-11857-1-git-send-email-lukasz.odzioba@intel.com> To: linux-tip-commits@vger.kernel.org Subject: [tip:x86/urgent] x86/cpu: Fix bootup crashes by sanitizing the argument of the 'clearcpuid=' command-line option Git-Commit-ID: dd853fd216d1485ed3045ff772079cc8689a9a4a X-Mailer: tip-git-log-daemon Robot-ID: Robot-Unsubscribe: Contact to get blacklisted from these emails MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Content-Type: text/plain; charset=UTF-8 Content-Disposition: inline Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Commit-ID: dd853fd216d1485ed3045ff772079cc8689a9a4a Gitweb: http://git.kernel.org/tip/dd853fd216d1485ed3045ff772079cc8689a9a4a Author: Lukasz Odzioba AuthorDate: Wed, 28 Dec 2016 14:55:40 +0100 Committer: Ingo Molnar CommitDate: Thu, 5 Jan 2017 08:54:34 +0100 x86/cpu: Fix bootup crashes by sanitizing the argument of the 'clearcpuid=' command-line option A negative number can be specified in the cmdline which will be used as setup_clear_cpu_cap() argument. With that we can clear/set some bit in memory predceeding boot_cpu_data/cpu_caps_cleared which may cause kernel to misbehave. This patch adds lower bound check to setup_disablecpuid(). Boris Petkov reproduced a crash: [ 1.234575] BUG: unable to handle kernel paging request at ffffffff858bd540 [ 1.236535] IP: memcpy_erms+0x6/0x10 Signed-off-by: Lukasz Odzioba Acked-by: Borislav Petkov Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Thomas Gleixner Cc: andi.kleen@intel.com Cc: bp@alien8.de Cc: dave.hansen@linux.intel.com Cc: luto@kernel.org Cc: slaoub@gmail.com Fixes: ac72e7888a61 ("x86: add generic clearcpuid=... option") Link: http://lkml.kernel.org/r/1482933340-11857-1-git-send-email-lukasz.odzioba@intel.com Signed-off-by: Ingo Molnar --- arch/x86/kernel/cpu/common.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c index dc1697c..9bab7a8 100644 --- a/arch/x86/kernel/cpu/common.c +++ b/arch/x86/kernel/cpu/common.c @@ -1221,7 +1221,7 @@ static __init int setup_disablecpuid(char *arg) { int bit; - if (get_option(&arg, &bit) && bit < NCAPINTS*32) + if (get_option(&arg, &bit) && bit >= 0 && bit < NCAPINTS * 32) setup_clear_cpu_cap(bit); else return 0;