Commit d0fa6ea1 authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge branch 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip 

Pull x86 fixes from Thomas Gleixner:

 - Expand the space for uncompressing as the LZ4 worst case does not fit
   into the currently reserved space

 - Validate boot parameters more strictly to prevent out of bound access
   in the decompressor/boot code

 - Fix off by one errors in get_segment_base()

* 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  x86/boot: Prevent faulty bootparams.screeninfo from causing harm
  x86/boot: Provide more slack space during decompression
  x86/ldt: Fix off by one in get_segment_base()
parents 3b62dc6c fb1cc2f9

arch/x86/boot/compressed/misc.c

+1 −2
Original line number Diff line number Diff line
@@ -116,8 +116,7 @@ void __putstr(const char *s) 
		}

	}



	if (boot_params->screen_info.orig_video_mode == 0 &&

	    lines == 0 && cols == 0)

	if (lines == 0 || cols == 0)

		return;



	x = boot_params->screen_info.orig_x;

arch/x86/boot/header.S

+7 −1
Original line number Diff line number Diff line
@@ -520,8 +520,14 @@ pref_address: .quad LOAD_PHYSICAL_ADDR # preferred load addr 
# the description in lib/decompressor_xxx.c for specific information.

#

# extra_bytes = (uncompressed_size >> 12) + 65536 + 128

#

# LZ4 is even worse: data that cannot be further compressed grows by 0.4%,

# or one byte per 256 bytes. OTOH, we can safely get rid of the +128 as

# the size-dependent part now grows so fast.

#

# extra_bytes = (uncompressed_size >> 8) + 65536



#define ZO_z_extra_bytes	((ZO_z_output_len >> 12) + 65536 + 128)

#define ZO_z_extra_bytes	((ZO_z_output_len >> 8) + 65536)

#if ZO_z_output_len > ZO_z_input_len

# define ZO_z_extract_offset	(ZO_z_output_len + ZO_z_extra_bytes - \

				 ZO_z_input_len)

arch/x86/events/core.c

+2 −5
Original line number Diff line number Diff line
@@ -2335,12 +2335,9 @@ static unsigned long get_segment_base(unsigned int segment) 
#ifdef CONFIG_MODIFY_LDT_SYSCALL

		struct ldt_struct *ldt;



		if (idx > LDT_ENTRIES)

			return 0;



		/* IRQs are off, so this synchronizes with smp_store_release */

		ldt = lockless_dereference(current->active_mm->context.ldt);

		if (!ldt || idx > ldt->nr_entries)

		if (!ldt || idx >= ldt->nr_entries)

			return 0;



		desc = &ldt->entries[idx];
@@ -2348,7 +2345,7 @@ static unsigned long get_segment_base(unsigned int segment) 
		return 0;

#endif

	} else {

		if (idx > GDT_ENTRIES)

		if (idx >= GDT_ENTRIES)

			return 0;



		desc = raw_cpu_ptr(gdt_page.gdt) + idx;

CRA Git | Maintained and supported by SUSTech CRA and CCSE