From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Mon, 10 Sep 2018 07:16:14 +0000 (+0200)
Subject: 4.9-stable patches
X-Git-Tag: v4.4.156~41
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=0d655136163de389266a02ecce64d048d2fb0614;p=thirdparty%2Fkernel%2Fstable-queue.git

4.9-stable patches

added patches:
	x86-speculation-l1tf-fix-up-pte-pfn-conversion-for-pae.patch
---

diff --git a/queue-4.9/x86-speculation-l1tf-fix-up-pte-pfn-conversion-for-pae.patch b/queue-4.9/x86-speculation-l1tf-fix-up-pte-pfn-conversion-for-pae.patch
new file mode 100644
index 00000000000..be18fd2c334
--- /dev/null
+++ b/queue-4.9/x86-speculation-l1tf-fix-up-pte-pfn-conversion-for-pae.patch
@@ -0,0 +1,41 @@
+From e14d7dfb41f5807a0c1c26a13f2b8ef16af24935 Mon Sep 17 00:00:00 2001
+From: Michal Hocko <mhocko@suse.cz>
+Date: Wed, 27 Jun 2018 17:46:50 +0200
+Subject: x86/speculation/l1tf: Fix up pte->pfn conversion for PAE
+
+From: Michal Hocko <mhocko@suse.cz>
+
+commit e14d7dfb41f5807a0c1c26a13f2b8ef16af24935 upstream.
+
+Jan has noticed that pte_pfn and co. resp. pfn_pte are incorrect for
+CONFIG_PAE because phys_addr_t is wider than unsigned long and so the
+pte_val reps. shift left would get truncated. Fix this up by using proper
+types.
+
+[Just one chunk, again, needed here.  Thanks to Ben and Guenter for
+finding and fixing this. - gregkh]
+
+Fixes: 6b28baca9b1f ("x86/speculation/l1tf: Protect PROT_NONE PTEs against speculation")
+Reported-by: Jan Beulich <JBeulich@suse.com>
+Signed-off-by: Michal Hocko <mhocko@suse.com>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Acked-by: Vlastimil Babka <vbabka@suse.cz>
+Cc: Guenter Roeck <linux@roeck-us.net>
+Cc: Ben Hutchings <ben.hutchings@codethink.co.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/x86/include/asm/pgtable.h |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/x86/include/asm/pgtable.h
++++ b/arch/x86/include/asm/pgtable.h
+@@ -420,7 +420,7 @@ static inline pmd_t pfn_pmd(unsigned lon
+ 
+ static inline pud_t pfn_pud(unsigned long page_nr, pgprot_t pgprot)
+ {
+-	phys_addr_t pfn = page_nr << PAGE_SHIFT;
++	phys_addr_t pfn = (phys_addr_t)page_nr << PAGE_SHIFT;
+ 	pfn ^= protnone_mask(pgprot_val(pgprot));
+ 	pfn &= PHYSICAL_PUD_PAGE_MASK;
+ 	return __pud(pfn | massage_pgprot(pgprot));