x86/cpu_entry_area: Prevent wraparound in setup_cpu_entry_area_ptes() on 32bit

KAGA-KOKO · KAGA-KOKO · commit f6c4fd506cb6 · 2017-12-23T20:18:42.000+01:00
The loop which populates the CPU entry area PMDs can wrap around on 32bit machines when the number of CPUs is small. It worked wonderful for NR_CPUS=64 for whatever reason and the moron who wrote that code did not bother to test it with !SMP. Check for the wraparound to fix it. Fixes: 92a0f81 ("x86/cpu_entry_area: Move it out of the fixmap") Reported-by: kernel test robot <fengguang.wu@intel.com> Signed-off-by: Thomas "Feels stupid" Gleixner <tglx@linutronix.de> Tested-by: Borislav Petkov <bp@alien8.de>
diff --git a/arch/x86/mm/cpu_entry_area.c b/arch/x86/mm/cpu_entry_area.c
@@ -122,7 +122,8 @@ static __init void setup_cpu_entry_area_ptes(void)
 	start = CPU_ENTRY_AREA_BASE;
 	end = start + CPU_ENTRY_AREA_MAP_SIZE;
 
-	for (; start < end; start += PMD_SIZE)
+	/* Careful here: start + PMD_SIZE might wrap around */
+	for (; start < end && start >= CPU_ENTRY_AREA_BASE; start += PMD_SIZE)
 		populate_extra_pte(start);
 #endif
 }

Original file line number	Diff line number	Diff line change
`@@ -122,7 +122,8 @@ static __init void setup_cpu_entry_area_ptes(void)`
`122`	`122`	`start = CPU_ENTRY_AREA_BASE;`
`123`	`123`	`end = start + CPU_ENTRY_AREA_MAP_SIZE;`
`124`	`124`
`125`		`- for (; start < end; start += PMD_SIZE)`
	`125`	`+ /* Careful here: start + PMD_SIZE might wrap around */`
	`126`	`+ for (; start < end && start >= CPU_ENTRY_AREA_BASE; start += PMD_SIZE)`
`126`	`127`	`populate_extra_pte(start);`
`127`	`128`	`#endif`
`128`	`129`	`}`