4.14-stable patches

added patches:
	x86-crash-fix-crash_setup_memmap_entries-out-of-bounds-access.patch

diff --git a/queue-4.14/series b/queue-4.14/series
index 88232dfcf423ef465ab72716aeaf65627241a8c0..48d3ba30f3aba558a3afab251a160d2ace7b8b94 100644 (file)
--- a/queue-4.14/series
+++ b/queue-4.14/series
@@ -46,3 +46,4 @@ xen-netback-check-for-hotplug-status-existence-befor.patch
 cavium-liquidio-fix-duplicate-argument.patch
 ia64-fix-discontig.c-section-mismatches.patch
 ia64-tools-remove-duplicate-definition-of-ia64_mf-on.patch
+x86-crash-fix-crash_setup_memmap_entries-out-of-bounds-access.patch

diff --git a/queue-4.14/x86-crash-fix-crash_setup_memmap_entries-out-of-bounds-access.patch b/queue-4.14/x86-crash-fix-crash_setup_memmap_entries-out-of-bounds-access.patch
new file mode 100644 (file)
index 0000000..87572d1
--- /dev/null
+++ b/queue-4.14/x86-crash-fix-crash_setup_memmap_entries-out-of-bounds-access.patch
@@ -0,0 +1,69 @@
+From 5849cdf8c120e3979c57d34be55b92d90a77a47e Mon Sep 17 00:00:00 2001
+From: Mike Galbraith <efault@gmx.de>
+Date: Fri, 16 Apr 2021 14:02:07 +0200
+Subject: x86/crash: Fix crash_setup_memmap_entries() out-of-bounds access
+
+From: Mike Galbraith <efault@gmx.de>
+
+commit 5849cdf8c120e3979c57d34be55b92d90a77a47e upstream.
+
+Commit in Fixes: added support for kexec-ing a kernel on panic using a
+new system call. As part of it, it does prepare a memory map for the new
+kernel.
+
+However, while doing so, it wrongly accesses memory it has not
+allocated: it accesses the first element of the cmem->ranges[] array in
+memmap_exclude_ranges() but it has not allocated the memory for it in
+crash_setup_memmap_entries(). As KASAN reports:
+
+  BUG: KASAN: vmalloc-out-of-bounds in crash_setup_memmap_entries+0x17e/0x3a0
+  Write of size 8 at addr ffffc90000426008 by task kexec/1187
+
+  (gdb) list *crash_setup_memmap_entries+0x17e
+  0xffffffff8107cafe is in crash_setup_memmap_entries (arch/x86/kernel/crash.c:322).
+  317                                      unsigned long long mend)
+  318     {
+  319             unsigned long start, end;
+  320
+  321             cmem->ranges[0].start = mstart;
+  322             cmem->ranges[0].end = mend;
+  323             cmem->nr_ranges = 1;
+  324
+  325             /* Exclude elf header region */
+  326             start = image->arch.elf_load_addr;
+  (gdb)
+
+Make sure the ranges array becomes a single element allocated.
+
+ [ bp: Write a proper commit message. ]
+
+Fixes: dd5f726076cc ("kexec: support for kexec on panic using new system call")
+Signed-off-by: Mike Galbraith <efault@gmx.de>
+Signed-off-by: Borislav Petkov <bp@suse.de>
+Reviewed-by: Dave Young <dyoung@redhat.com>
+Cc: <stable@vger.kernel.org>
+Link: https://lkml.kernel.org/r/725fa3dc1da2737f0f6188a1a9701bead257ea9d.camel@gmx.de
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/x86/kernel/crash.c |    3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/arch/x86/kernel/crash.c
++++ b/arch/x86/kernel/crash.c
+@@ -23,6 +23,7 @@
+ #include <linux/export.h>
+ #include <linux/slab.h>
+ #include <linux/vmalloc.h>
++#include <linux/overflow.h>
+ 
+ #include <asm/processor.h>
+ #include <asm/hardirq.h>
+@@ -565,7 +566,7 @@ int crash_setup_memmap_entries(struct ki
+       struct crash_memmap_data cmd;
+       struct crash_mem *cmem;
+ 
+-      cmem = vzalloc(sizeof(struct crash_mem));
++      cmem = vzalloc(struct_size(cmem, ranges, 1));
+       if (!cmem)
+               return -ENOMEM;
+