5.11-stable patches

added patches:
	x86-crash-fix-crash_setup_memmap_entries-out-of-bounds-access.patch

diff --git a/queue-5.11/series b/queue-5.11/series
index c6657f663d0408f888beeac458779de1b901c2ff..fc0400332aa1e79019c0d218b09df7456f491a22 100644 (file)
--- a/queue-5.11/series
+++ b/queue-5.11/series
@@ -38,3 +38,4 @@ cavium-liquidio-fix-duplicate-argument.patch
 csky-change-a-kconfig-symbol-name-to-fix-e1000-build.patch
 ia64-fix-discontig.c-section-mismatches.patch
 ia64-tools-remove-duplicate-definition-of-ia64_mf-on.patch
+x86-crash-fix-crash_setup_memmap_entries-out-of-bounds-access.patch

diff --git a/queue-5.11/x86-crash-fix-crash_setup_memmap_entries-out-of-bounds-access.patch b/queue-5.11/x86-crash-fix-crash_setup_memmap_entries-out-of-bounds-access.patch
new file mode 100644 (file)
index 0000000..78a458e
--- /dev/null
+++ b/queue-5.11/x86-crash-fix-crash_setup_memmap_entries-out-of-bounds-access.patch
@@ -0,0 +1,61 @@
+From 5849cdf8c120e3979c57d34be55b92d90a77a47e Mon Sep 17 00:00:00 2001
+From: Mike Galbraith <efault@gmx.de>
+Date: Fri, 16 Apr 2021 14:02:07 +0200
+Subject: x86/crash: Fix crash_setup_memmap_entries() out-of-bounds access
+
+From: Mike Galbraith <efault@gmx.de>
+
+commit 5849cdf8c120e3979c57d34be55b92d90a77a47e upstream.
+
+Commit in Fixes: added support for kexec-ing a kernel on panic using a
+new system call. As part of it, it does prepare a memory map for the new
+kernel.
+
+However, while doing so, it wrongly accesses memory it has not
+allocated: it accesses the first element of the cmem->ranges[] array in
+memmap_exclude_ranges() but it has not allocated the memory for it in
+crash_setup_memmap_entries(). As KASAN reports:
+
+  BUG: KASAN: vmalloc-out-of-bounds in crash_setup_memmap_entries+0x17e/0x3a0
+  Write of size 8 at addr ffffc90000426008 by task kexec/1187
+
+  (gdb) list *crash_setup_memmap_entries+0x17e
+  0xffffffff8107cafe is in crash_setup_memmap_entries (arch/x86/kernel/crash.c:322).
+  317                                      unsigned long long mend)
+  318     {
+  319             unsigned long start, end;
+  320
+  321             cmem->ranges[0].start = mstart;
+  322             cmem->ranges[0].end = mend;
+  323             cmem->nr_ranges = 1;
+  324
+  325             /* Exclude elf header region */
+  326             start = image->arch.elf_load_addr;
+  (gdb)
+
+Make sure the ranges array becomes a single element allocated.
+
+ [ bp: Write a proper commit message. ]
+
+Fixes: dd5f726076cc ("kexec: support for kexec on panic using new system call")
+Signed-off-by: Mike Galbraith <efault@gmx.de>
+Signed-off-by: Borislav Petkov <bp@suse.de>
+Reviewed-by: Dave Young <dyoung@redhat.com>
+Cc: <stable@vger.kernel.org>
+Link: https://lkml.kernel.org/r/725fa3dc1da2737f0f6188a1a9701bead257ea9d.camel@gmx.de
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/x86/kernel/crash.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/x86/kernel/crash.c
++++ b/arch/x86/kernel/crash.c
+@@ -337,7 +337,7 @@ int crash_setup_memmap_entries(struct ki
+       struct crash_memmap_data cmd;
+       struct crash_mem *cmem;
+ 
+-      cmem = vzalloc(sizeof(struct crash_mem));
++      cmem = vzalloc(struct_size(cmem, ranges, 1));
+       if (!cmem)
+               return -ENOMEM;
+