Pull x86 fixes from Thomas Gleixner: - Expand the space for uncompressing as the LZ4 worst case does not fit into the currently reserved space - Validate boot parameters more strictly to prevent out of bound access in the decompressor/boot code - Fix off by one errors in get_segment_base() * 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/boot: Prevent faulty bootparams.screeninfo from causing harm x86/boot: Provide more slack space during decompression x86/ldt: Fix off by one in get_segment_base()
Unified · Split
| @@ -116,8 +116,7 @@ void __putstr(const char *s) · 115 unmodified lines | |||
| 116 | } | 116 | } |
| 117 | } | 117 | } |
| 118 | 118 | ||
| 119 | if (boot_params->screen_info.orig_video_mode == 0 && | 119 | if (lines == 0 || cols == 0) |
| 120 | lines == 0 && cols == 0) | ||
| 121 | return; | 120 | return; |
| 122 | 121 | ||
| 123 | x = boot_params->screen_info.orig_x; | 122 | x = boot_params->screen_info.orig_x; |
| @@ -520,8 +520,14 @@ pref_address: .quad LOAD_PHYSICAL_ADDR # preferred load addr · 519 unmodified lines | |||
| 520 | # the description in lib/decompressor_xxx.c for specific information. | 520 | # the description in lib/decompressor_xxx.c for specific information. |
| 521 | # | 521 | # |
| 522 | # extra_bytes = (uncompressed_size >> 12) + 65536 + 128 | 522 | # extra_bytes = (uncompressed_size >> 12) + 65536 + 128 |
| 523 | # | ||
| 524 | # LZ4 is even worse: data that cannot be further compressed grows by 0.4%, | ||
| 525 | # or one byte per 256 bytes. OTOH, we can safely get rid of the +128 as | ||
| 526 | # the size-dependent part now grows so fast. | ||
| 527 | # | ||
| 528 | # extra_bytes = (uncompressed_size >> 8) + 65536 | ||
| 523 | 529 | ||
| 524 | #define ZO_z_extra_bytes ((ZO_z_output_len >> 12) + 65536 + 128) | 530 | #define ZO_z_extra_bytes ((ZO_z_output_len >> 8) + 65536) |
| 525 | #if ZO_z_output_len > ZO_z_input_len | 531 | #if ZO_z_output_len > ZO_z_input_len |
| 526 | # define ZO_z_extract_offset (ZO_z_output_len + ZO_z_extra_bytes - \ | 532 | # define ZO_z_extract_offset (ZO_z_output_len + ZO_z_extra_bytes - \ |
| 527 | ZO_z_input_len) | 533 | ZO_z_input_len) |
| @@ -2335,12 +2335,9 @@ static unsigned long get_segment_base(unsigned int segment) · 2334 unmodified lines | |||
| 2335 | #ifdef CONFIG_MODIFY_LDT_SYSCALL | 2335 | #ifdef CONFIG_MODIFY_LDT_SYSCALL |
| 2336 | struct ldt_struct *ldt; | 2336 | struct ldt_struct *ldt; |
| 2337 | 2337 | ||
| 2338 | if (idx > LDT_ENTRIES) | ||
| 2339 | return 0; | ||
| 2340 | |||
| 2341 | /* IRQs are off, so this synchronizes with smp_store_release */ | 2338 | /* IRQs are off, so this synchronizes with smp_store_release */ |
| 2342 | ldt = lockless_dereference(current->active_mm->context.ldt); | 2339 | ldt = lockless_dereference(current->active_mm->context.ldt); |
| 2343 | if (!ldt || idx > ldt->nr_entries) | 2340 | if (!ldt || idx >= ldt->nr_entries) |
| 2344 | return 0; | 2341 | return 0; |
| 2345 | 2342 | ||
| 2346 | desc = &ldt->entries[idx]; | 2343 | desc = &ldt->entries[idx]; |
| @@ -2348,7 +2345,7 @@ static unsigned long get_segment_base(unsigned int segment) · 1 unmodified line | |||
| 2348 | return 0; | 2345 | return 0; |
| 2349 | #endif | 2346 | #endif |
| 2350 | } else { | 2347 | } else { |
| 2351 | if (idx > GDT_ENTRIES) | 2348 | if (idx >= GDT_ENTRIES) |
| 2352 | return 0; | 2349 | return 0; |
| 2353 | 2350 | ||
| 2354 | desc = raw_cpu_ptr(gdt_page.gdt) + idx; | 2351 | desc = raw_cpu_ptr(gdt_page.gdt) + idx; |