| From dd853fd216d1485ed3045ff772079cc8689a9a4a Mon Sep 17 00:00:00 2001 |
| From: Lukasz Odzioba <lukasz.odzioba@intel.com> |
| Date: Wed, 28 Dec 2016 14:55:40 +0100 |
| Subject: x86/cpu: Fix bootup crashes by sanitizing the argument of the 'clearcpuid=' command-line option |
| |
| From: Lukasz Odzioba <lukasz.odzioba@intel.com> |
| |
| commit dd853fd216d1485ed3045ff772079cc8689a9a4a upstream. |
| |
| A negative number can be specified in the cmdline which will be used as |
| setup_clear_cpu_cap() argument. With that we can clear/set some bit in |
| memory predceeding boot_cpu_data/cpu_caps_cleared which may cause kernel |
| to misbehave. This patch adds lower bound check to setup_disablecpuid(). |
| |
| Boris Petkov reproduced a crash: |
| |
| [ 1.234575] BUG: unable to handle kernel paging request at ffffffff858bd540 |
| [ 1.236535] IP: memcpy_erms+0x6/0x10 |
| |
| Signed-off-by: Lukasz Odzioba <lukasz.odzioba@intel.com> |
| Acked-by: Borislav Petkov <bp@suse.de> |
| Cc: Linus Torvalds <torvalds@linux-foundation.org> |
| Cc: Peter Zijlstra <peterz@infradead.org> |
| Cc: Thomas Gleixner <tglx@linutronix.de> |
| Cc: andi.kleen@intel.com |
| Cc: bp@alien8.de |
| Cc: dave.hansen@linux.intel.com |
| Cc: luto@kernel.org |
| Cc: slaoub@gmail.com |
| Fixes: ac72e7888a61 ("x86: add generic clearcpuid=... option") |
| Link: http://lkml.kernel.org/r/1482933340-11857-1-git-send-email-lukasz.odzioba@intel.com |
| Signed-off-by: Ingo Molnar <mingo@kernel.org> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| |
| --- |
| arch/x86/kernel/cpu/common.c | 2 +- |
| 1 file changed, 1 insertion(+), 1 deletion(-) |
| |
| --- a/arch/x86/kernel/cpu/common.c |
| +++ b/arch/x86/kernel/cpu/common.c |
| @@ -1129,7 +1129,7 @@ static __init int setup_disablecpuid(cha |
| { |
| int bit; |
| |
| - if (get_option(&arg, &bit) && bit < NCAPINTS*32) |
| + if (get_option(&arg, &bit) && bit >= 0 && bit < NCAPINTS * 32) |
| setup_clear_cpu_cap(bit); |
| else |
| return 0; |