Patch "KVM: x86: fix conversion of addresses to linear in 32-bit protected mode" has been added to the 4.4-stable tree

Patch "KVM: x86: fix conversion of addresses to linear in 32-bit protected mode" has been added to the 4.4-stable tree

[gregkh]

This is a note to let you know that I've just added the patch titled

    KVM: x86: fix conversion of addresses to linear in 32-bit protected mode

to the 4.4-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     kvm-x86-fix-conversion-of-addresses-to-linear-in-32-bit-protected-mode.patch
and it can be found in the queue-4.4 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@vger.kernel.org> know about it.


>From 0c1d77f4ba5cc9c05a29adca3d6466cdf4969b70 Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Fri, 19 Feb 2016 18:07:21 +0100
Subject: KVM: x86: fix conversion of addresses to linear in 32-bit protected mode

From: Paolo Bonzini <pbonzini@redhat.com>

commit 0c1d77f4ba5cc9c05a29adca3d6466cdf4969b70 upstream.

Commit e8dd2d2d641c ("Silence compiler warning in arch/x86/kvm/emulate.c",
2015-09-06) broke boot of the Hurd.  The bug is that the "default:"
case actually could modify "la", but after the patch this change is
not reflected in *linear.

The bug is visible whenever a non-zero segment base causes the linear
address to wrap around the 4GB mark.

Fixes: e8dd2d2d641cb2724ee10e76c0ad02e04289c017
Reported-by: Aurelien Jarno <aurelien@aurel32.net>
Tested-by: Aurelien Jarno <aurelien@aurel32.net>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/x86/kvm/emulate.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

--- a/arch/x86/kvm/emulate.c
+++ b/arch/x86/kvm/emulate.c
@@ -650,10 +650,10 @@ static __always_inline int __linearize(s
 	u16 sel;
 
 	la = seg_base(ctxt, addr.seg) + addr.ea;
-	*linear = la;
 	*max_size = 0;
 	switch (mode) {
 	case X86EMUL_MODE_PROT64:
+		*linear = la;
 		if (is_noncanonical_address(la))
 			goto bad;
 
@@ -662,6 +662,7 @@ static __always_inline int __linearize(s
 			goto bad;
 		break;
 	default:
+		*linear = la = (u32)la;
 		usable = ctxt->ops->get_segment(ctxt, &sel, &desc, NULL,
 						addr.seg);
 		if (!usable)
@@ -689,7 +690,6 @@ static __always_inline int __linearize(s
 			if (size > *max_size)
 				goto bad;
 		}
-		la &= (u32)-1;
 		break;
 	}
 	if (insn_aligned(ctxt, size) && ((la & (size - 1)) != 0))


Patches currently in stable-queue which might be from pbonzini@redhat.com are

queue-4.4/kvm-x86-fix-conversion-of-addresses-to-linear-in-32-bit-protected-mode.patch
queue-4.4/kvm-x86-mmu-fix-ubsan-index-out-of-range-warning.patch
queue-4.4/kvm-x86-fix-missed-hardware-breakpoints.patch
queue-4.4/kvm-async_pf-do-not-warn-on-page-allocation-failures.patch