linux-kernel.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Arvind Sankar <nivedita@alum.mit.edu>,
	Ard Biesheuvel <ardb@kernel.org>, Ingo Molnar <mingo@kernel.org>,
	Sasha Levin <sashal@kernel.org>
Subject: [PATCH AUTOSEL 5.4 29/46] x86/boot: Use unsigned comparison for addresses
Date: Thu,  9 Apr 2020 23:48:52 -0400	[thread overview]
Message-ID: <20200410034909.8922-29-sashal@kernel.org> (raw)
In-Reply-To: <20200410034909.8922-1-sashal@kernel.org>

From: Arvind Sankar <nivedita@alum.mit.edu>

[ Upstream commit 81a34892c2c7c809f9c4e22c5ac936ae673fb9a2 ]

The load address is compared with LOAD_PHYSICAL_ADDR using a signed
comparison currently (using jge instruction).

When loading a 64-bit kernel using the new efi32_pe_entry() point added by:

  97aa276579b2 ("efi/x86: Add true mixed mode entry point into .compat section")

using Qemu with -m 3072, the firmware actually loads us above 2Gb,
resulting in a very early crash.

Use the JAE instruction to perform a unsigned comparison instead, as physical
addresses should be considered unsigned.

Signed-off-by: Arvind Sankar <nivedita@alum.mit.edu>
Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Link: https://lore.kernel.org/r/20200301230436.2246909-6-nivedita@alum.mit.edu
Link: https://lore.kernel.org/r/20200308080859.21568-14-ardb@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/x86/boot/compressed/head_32.S | 2 +-
 arch/x86/boot/compressed/head_64.S | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/arch/x86/boot/compressed/head_32.S b/arch/x86/boot/compressed/head_32.S
index 5e30eaaf8576f..70ffce98c5683 100644
--- a/arch/x86/boot/compressed/head_32.S
+++ b/arch/x86/boot/compressed/head_32.S
@@ -106,7 +106,7 @@ ENTRY(startup_32)
 	notl	%eax
 	andl    %eax, %ebx
 	cmpl	$LOAD_PHYSICAL_ADDR, %ebx
-	jge	1f
+	jae	1f
 #endif
 	movl	$LOAD_PHYSICAL_ADDR, %ebx
 1:
diff --git a/arch/x86/boot/compressed/head_64.S b/arch/x86/boot/compressed/head_64.S
index e9a7f7cadb121..07d2002da642a 100644
--- a/arch/x86/boot/compressed/head_64.S
+++ b/arch/x86/boot/compressed/head_64.S
@@ -106,7 +106,7 @@ ENTRY(startup_32)
 	notl	%eax
 	andl	%eax, %ebx
 	cmpl	$LOAD_PHYSICAL_ADDR, %ebx
-	jge	1f
+	jae	1f
 #endif
 	movl	$LOAD_PHYSICAL_ADDR, %ebx
 1:
@@ -297,7 +297,7 @@ ENTRY(startup_64)
 	notq	%rax
 	andq	%rax, %rbp
 	cmpq	$LOAD_PHYSICAL_ADDR, %rbp
-	jge	1f
+	jae	1f
 #endif
 	movq	$LOAD_PHYSICAL_ADDR, %rbp
 1:
-- 
2.20.1


  parent reply	other threads:[~2020-04-10  3:49 UTC|newest]

Thread overview: 46+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2020-04-10  3:48 [PATCH AUTOSEL 5.4 01/46] cpufreq: imx6q: Fixes unwanted cpu overclocking on i.MX6ULL Sasha Levin
2020-04-10  3:48 ` [PATCH AUTOSEL 5.4 02/46] staging: wilc1000: avoid double unlocking of 'wilc->hif_cs' mutex Sasha Levin
2020-04-10  3:48 ` [PATCH AUTOSEL 5.4 03/46] media: venus: hfi_parser: Ignore HEVC encoding for V1 Sasha Levin
2020-04-10  3:48 ` [PATCH AUTOSEL 5.4 04/46] firmware: arm_sdei: fix double-lock on hibernate with shared events Sasha Levin
2020-04-10  3:48 ` [PATCH AUTOSEL 5.4 05/46] null_blk: Fix the null_add_dev() error path Sasha Levin
2020-04-10  3:48 ` [PATCH AUTOSEL 5.4 06/46] null_blk: Handle null_add_dev() failures properly Sasha Levin
2020-04-10  3:48 ` [PATCH AUTOSEL 5.4 07/46] null_blk: fix spurious IO errors after failed past-wp access Sasha Levin
2020-04-10  3:48 ` [PATCH AUTOSEL 5.4 08/46] media: imx: imx7_mipi_csis: Power off the source when stopping streaming Sasha Levin
2020-04-10  3:48 ` [PATCH AUTOSEL 5.4 09/46] media: imx: imx7-media-csi: Fix video field handling Sasha Levin
2020-04-10  3:48 ` [PATCH AUTOSEL 5.4 10/46] xhci: bail out early if driver can't accress host in resume Sasha Levin
2020-04-10  3:48 ` [PATCH AUTOSEL 5.4 11/46] ACPI: EC: Do not clear boot_ec_is_ecdt in acpi_ec_add() Sasha Levin
2020-04-10  3:48 ` [PATCH AUTOSEL 5.4 12/46] x86: Don't let pgprot_modify() change the page encryption bit Sasha Levin
2020-04-10  3:48 ` [PATCH AUTOSEL 5.4 13/46] dma-mapping: Fix dma_pgprot() for unencrypted coherent pages Sasha Levin
2020-04-10  3:48 ` [PATCH AUTOSEL 5.4 14/46] block: keep bdi->io_pages in sync with max_sectors_kb for stacked devices Sasha Levin
2020-04-10  3:48 ` [PATCH AUTOSEL 5.4 15/46] debugfs: Check module state before warning in {full/open}_proxy_open() Sasha Levin
2020-04-10  3:48 ` [PATCH AUTOSEL 5.4 16/46] irqchip/versatile-fpga: Handle chained IRQs properly Sasha Levin
2020-04-10  3:48 ` [PATCH AUTOSEL 5.4 17/46] time/sched_clock: Expire timer in hardirq context Sasha Levin
2020-04-10  3:48 ` [PATCH AUTOSEL 5.4 18/46] media: allegro: fix type of gop_length in channel_create message Sasha Levin
2020-04-10  3:48 ` [PATCH AUTOSEL 5.4 19/46] sched: Avoid scale real weight down to zero Sasha Levin
2020-04-10  3:48 ` [PATCH AUTOSEL 5.4 20/46] selftests/x86/ptrace_syscall_32: Fix no-vDSO segfault Sasha Levin
2020-04-10  3:48 ` [PATCH AUTOSEL 5.4 21/46] PCI/switchtec: Fix init_completion race condition with poll_wait() Sasha Levin
2020-04-10  3:48 ` [PATCH AUTOSEL 5.4 22/46] block, bfq: move forward the getting of an extra ref in bfq_bfqq_move Sasha Levin
2020-04-10  3:48 ` [PATCH AUTOSEL 5.4 23/46] media: i2c: video-i2c: fix build errors due to 'imply hwmon' Sasha Levin
2020-04-10  3:48 ` [PATCH AUTOSEL 5.4 24/46] libata: Remove extra scsi_host_put() in ata_scsi_add_hosts() Sasha Levin
2020-04-10  3:48 ` [PATCH AUTOSEL 5.4 25/46] pstore/platform: fix potential mem leak if pstore_init_fs failed Sasha Levin
2020-04-10  3:48 ` [PATCH AUTOSEL 5.4 26/46] gfs2: Do log_flush in gfs2_ail_empty_gl even if ail list is empty Sasha Levin
2020-04-10  3:48 ` [PATCH AUTOSEL 5.4 27/46] gfs2: Don't demote a glock until its revokes are written Sasha Levin
2020-04-10  3:48 ` [PATCH AUTOSEL 5.4 28/46] cpufreq: imx6q: fix error handling Sasha Levin
2020-04-10  3:48 ` Sasha Levin [this message]
2020-04-10  3:48 ` [PATCH AUTOSEL 5.4 30/46] efi/x86: Ignore the memory attributes table on i386 Sasha Levin
2020-04-10  3:48 ` [PATCH AUTOSEL 5.4 31/46] genirq/irqdomain: Check pointer in irq_domain_alloc_irqs_hierarchy() Sasha Levin
2020-04-10  3:48 ` [PATCH AUTOSEL 5.4 32/46] blk-mq: Keep set->nr_hw_queues and set->map[].nr_queues in sync Sasha Levin
2020-04-10  3:48 ` [PATCH AUTOSEL 5.4 33/46] block: Fix use-after-free issue accessing struct io_cq Sasha Levin
2020-04-10  3:48 ` [PATCH AUTOSEL 5.4 34/46] media: i2c: ov5695: Fix power on and off sequences Sasha Levin
2020-04-10  3:48 ` [PATCH AUTOSEL 5.4 35/46] usb: dwc3: core: add support for disabling SS instances in park mode Sasha Levin
2020-04-10  3:48 ` [PATCH AUTOSEL 5.4 36/46] irqchip/gic-v4: Provide irq_retrigger to avoid circular locking dependency Sasha Levin
2020-04-10  3:49 ` [PATCH AUTOSEL 5.4 37/46] md: check arrays is suspended in mddev_detach before call quiesce operations Sasha Levin
2020-04-10  3:49 ` [PATCH AUTOSEL 5.4 38/46] firmware: fix a double abort case with fw_load_sysfs_fallback Sasha Levin
2020-04-10  3:49 ` [PATCH AUTOSEL 5.4 39/46] spi: spi-fsl-dspi: Replace interruptible wait queue with a simple completion Sasha Levin
2020-04-10  3:49 ` [PATCH AUTOSEL 5.4 40/46] locking/lockdep: Avoid recursion in lockdep_count_{for,back}ward_deps() Sasha Levin
2020-04-10  3:49 ` [PATCH AUTOSEL 5.4 41/46] block, bfq: fix use-after-free in bfq_idle_slice_timer_body Sasha Levin
2020-04-10  3:49 ` [PATCH AUTOSEL 5.4 42/46] btrfs: hold a ref on the root in btrfs_recover_relocation Sasha Levin
2020-04-10  3:49 ` [PATCH AUTOSEL 5.4 43/46] btrfs: qgroup: ensure qgroup_rescan_running is only set when the worker is at least queued Sasha Levin
2020-04-10  3:49 ` [PATCH AUTOSEL 5.4 44/46] btrfs: remove a BUG_ON() from merge_reloc_roots() Sasha Levin
2020-04-10  3:49 ` [PATCH AUTOSEL 5.4 45/46] btrfs: restart relocate_tree_blocks properly Sasha Levin
2020-04-10  3:49 ` [PATCH AUTOSEL 5.4 46/46] btrfs: track reloc roots based on their commit root bytenr Sasha Levin

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20200410034909.8922-29-sashal@kernel.org \
    --to=sashal@kernel.org \
    --cc=ardb@kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=mingo@kernel.org \
    --cc=nivedita@alum.mit.edu \
    --cc=stable@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).