Re: [PATCH] Fix early panic on amd64 due to typo in supported CPU section

Re: [PATCH] Fix early panic on amd64 due to typo in supported CPU section

[Ingo Molnar]

* Petr Vandrovec <petr@vandrovec.name> wrote:

> Do not crash when enumerating supported CPU architectures
> 
> SECURITY_INIT somehow ended up in x86_cpu_dev.init section.  That caused printk
> in code which prints supported architectures to hit #GP due to non-canonical
> address being used.
> 
> Signed-off-by: Petr Vandrovec <petr@vandrovec.name>

thanks Petr, we had this bug fixed later in the patches but lets pick 
your fix right now before merging anything else. Applied it to 
tip/x86/urgent.

Linus,

Please pull the latest x86-fixes-for-linus git tree from:

   git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip.git x86-fixes-for-linus

 Thanks,

	Ingo

------------------>
Alan Cox (1):
      x86, early_ioremap: fix fencepost error

David Rientjes (1):
      x86: avoid dereferencing beyond stack + THREAD_SIZE

Petr Vandrovec (1):
      x86: fix early panic on amd64 due to typo in supported CPU section


 arch/x86/kernel/process_64.c     |    4 ++--
 arch/x86/kernel/vmlinux_64.lds.S |    2 +-
 arch/x86/mm/ioremap.c            |    2 +-
 3 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/arch/x86/kernel/process_64.c b/arch/x86/kernel/process_64.c
index 2a8ccb9..b6b508e 100644
--- a/arch/x86/kernel/process_64.c
+++ b/arch/x86/kernel/process_64.c
@@ -754,12 +754,12 @@ unsigned long get_wchan(struct task_struct *p)
 	if (!p || p == current || p->state == TASK_RUNNING)
 		return 0;
 	stack = (unsigned long)task_stack_page(p);
-	if (p->thread.sp < stack || p->thread.sp > stack+THREAD_SIZE)
+	if (p->thread.sp < stack || p->thread.sp >= stack+THREAD_SIZE)
 		return 0;
 	fp = *(u64 *)(p->thread.sp);
 	do {
 		if (fp < (unsigned long)stack ||
-		    fp > (unsigned long)stack+THREAD_SIZE)
+		    fp >= (unsigned long)stack+THREAD_SIZE)
 			return 0;
 		ip = *(u64 *)(fp+8);
 		if (!in_sched_functions(ip))
diff --git a/arch/x86/kernel/vmlinux_64.lds.S b/arch/x86/kernel/vmlinux_64.lds.S
index 201e81a..46e0544 100644
--- a/arch/x86/kernel/vmlinux_64.lds.S
+++ b/arch/x86/kernel/vmlinux_64.lds.S
@@ -172,8 +172,8 @@ SECTIONS
   .x86_cpu_dev.init : AT(ADDR(.x86_cpu_dev.init) - LOAD_OFFSET) {
 	*(.x86_cpu_dev.init)
   }
-  SECURITY_INIT
   __x86_cpu_dev_end = .;
+  SECURITY_INIT
 
   . = ALIGN(8);
   .parainstructions : AT(ADDR(.parainstructions) - LOAD_OFFSET) {
diff --git a/arch/x86/mm/ioremap.c b/arch/x86/mm/ioremap.c
index 6ab3196..10b5230 100644
--- a/arch/x86/mm/ioremap.c
+++ b/arch/x86/mm/ioremap.c
@@ -614,7 +614,7 @@ void __init *early_ioremap(unsigned long phys_addr, unsigned long size)
 	 */
 	offset = phys_addr & ~PAGE_MASK;
 	phys_addr &= PAGE_MASK;
-	size = PAGE_ALIGN(last_addr) - phys_addr;
+	size = PAGE_ALIGN(last_addr + 1) - phys_addr;
 
 	/*
 	 * Mappings have to fit in the FIX_BTMAP area.

[PATCH] Fix early panic on amd64 due to typo in supported CPU section

[Petr Vandrovec]

It seems that I forgot to CC LKML on that one...
						Petr

----- Forwarded message from Petr Vandrovec <petr@vandrovec.name> -----

Date: Sun, 12 Oct 2008 10:01:26 +0200
From: Petr Vandrovec <petr@vandrovec.name>
To: thomas.petazzoni@free-electrons.com
Cc: mingo@elte.hu, tglx@linutronix.de, torvalds@linux-foundation.org
Subject: [PATCH] Fix early panic on amd64 due to typo in supported CPU section

Do not crash when enumerating supported CPU architectures

SECURITY_INIT somehow ended up in x86_cpu_dev.init section.  That caused printk
in code which prints supported architectures to hit #GP due to non-canonical
address being used.

Signed-off-by: Petr Vandrovec <petr@vandrovec.name>

diff --git a/arch/x86/kernel/vmlinux_64.lds.S b/arch/x86/kernel/vmlinux_64.lds.S
index 201e81a..46e0544 100644
--- a/arch/x86/kernel/vmlinux_64.lds.S
+++ b/arch/x86/kernel/vmlinux_64.lds.S
@@ -172,8 +172,8 @@ SECTIONS
   .x86_cpu_dev.init : AT(ADDR(.x86_cpu_dev.init) - LOAD_OFFSET) {
 	*(.x86_cpu_dev.init)
   }
-  SECURITY_INIT
   __x86_cpu_dev_end = .;
+  SECURITY_INIT
 
   . = ALIGN(8);
   .parainstructions : AT(ADDR(.parainstructions) - LOAD_OFFSET) {

----- End forwarded message -----