From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Mon, 26 Apr 2021 05:57:32 +0000 (+0200)
Subject: 4.14-stable patches
X-Git-Tag: v4.4.268~12
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=eca2b1f1a6fe621f64a9d17e01d03a9811e26499;p=thirdparty%2Fkernel%2Fstable-queue.git

4.14-stable patches

added patches:
	x86-crash-fix-crash_setup_memmap_entries-out-of-bounds-access.patch
---

diff --git a/queue-4.14/series b/queue-4.14/series
index 88232dfcf42..48d3ba30f3a 100644
--- a/queue-4.14/series
+++ b/queue-4.14/series
@@ -46,3 +46,4 @@ xen-netback-check-for-hotplug-status-existence-befor.patch
 cavium-liquidio-fix-duplicate-argument.patch
 ia64-fix-discontig.c-section-mismatches.patch
 ia64-tools-remove-duplicate-definition-of-ia64_mf-on.patch
+x86-crash-fix-crash_setup_memmap_entries-out-of-bounds-access.patch
diff --git a/queue-4.14/x86-crash-fix-crash_setup_memmap_entries-out-of-bounds-access.patch b/queue-4.14/x86-crash-fix-crash_setup_memmap_entries-out-of-bounds-access.patch
new file mode 100644
index 00000000000..87572d1db64
--- /dev/null
+++ b/queue-4.14/x86-crash-fix-crash_setup_memmap_entries-out-of-bounds-access.patch
@@ -0,0 +1,69 @@
+From 5849cdf8c120e3979c57d34be55b92d90a77a47e Mon Sep 17 00:00:00 2001
+From: Mike Galbraith <efault@gmx.de>
+Date: Fri, 16 Apr 2021 14:02:07 +0200
+Subject: x86/crash: Fix crash_setup_memmap_entries() out-of-bounds access
+
+From: Mike Galbraith <efault@gmx.de>
+
+commit 5849cdf8c120e3979c57d34be55b92d90a77a47e upstream.
+
+Commit in Fixes: added support for kexec-ing a kernel on panic using a
+new system call. As part of it, it does prepare a memory map for the new
+kernel.
+
+However, while doing so, it wrongly accesses memory it has not
+allocated: it accesses the first element of the cmem->ranges[] array in
+memmap_exclude_ranges() but it has not allocated the memory for it in
+crash_setup_memmap_entries(). As KASAN reports:
+
+  BUG: KASAN: vmalloc-out-of-bounds in crash_setup_memmap_entries+0x17e/0x3a0
+  Write of size 8 at addr ffffc90000426008 by task kexec/1187
+
+  (gdb) list *crash_setup_memmap_entries+0x17e
+  0xffffffff8107cafe is in crash_setup_memmap_entries (arch/x86/kernel/crash.c:322).
+  317                                      unsigned long long mend)
+  318     {
+  319             unsigned long start, end;
+  320
+  321             cmem->ranges[0].start = mstart;
+  322             cmem->ranges[0].end = mend;
+  323             cmem->nr_ranges = 1;
+  324
+  325             /* Exclude elf header region */
+  326             start = image->arch.elf_load_addr;
+  (gdb)
+
+Make sure the ranges array becomes a single element allocated.
+
+ [ bp: Write a proper commit message. ]
+
+Fixes: dd5f726076cc ("kexec: support for kexec on panic using new system call")
+Signed-off-by: Mike Galbraith <efault@gmx.de>
+Signed-off-by: Borislav Petkov <bp@suse.de>
+Reviewed-by: Dave Young <dyoung@redhat.com>
+Cc: <stable@vger.kernel.org>
+Link: https://lkml.kernel.org/r/725fa3dc1da2737f0f6188a1a9701bead257ea9d.camel@gmx.de
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/x86/kernel/crash.c |    3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/arch/x86/kernel/crash.c
++++ b/arch/x86/kernel/crash.c
+@@ -23,6 +23,7 @@
+ #include <linux/export.h>
+ #include <linux/slab.h>
+ #include <linux/vmalloc.h>
++#include <linux/overflow.h>
+ 
+ #include <asm/processor.h>
+ #include <asm/hardirq.h>
+@@ -565,7 +566,7 @@ int crash_setup_memmap_entries(struct ki
+ 	struct crash_memmap_data cmd;
+ 	struct crash_mem *cmem;
+ 
+-	cmem = vzalloc(sizeof(struct crash_mem));
++	cmem = vzalloc(struct_size(cmem, ranges, 1));
+ 	if (!cmem)
+ 		return -ENOMEM;
+