From patchwork Fri May 5 19:47:29 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Arnd Bergmann X-Patchwork-Id: 98728 Delivered-To: patch@linaro.org Received: by 10.140.96.100 with SMTP id j91csp293493qge; Fri, 5 May 2017 12:50:16 -0700 (PDT) X-Received: by 10.99.61.206 with SMTP id k197mr5425691pga.68.1494013815204; Fri, 05 May 2017 12:50:15 -0700 (PDT) Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id c5si2571475pga.119.2017.05.05.12.50.12; Fri, 05 May 2017 12:50:15 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of stable-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; spf=pass (google.com: best guess record for domain of stable-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=stable-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755958AbdEETuK (ORCPT + 6 others); Fri, 5 May 2017 15:50:10 -0400 Received: from mout.kundenserver.de ([212.227.126.131]:51381 "EHLO mout.kundenserver.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1755862AbdEETst (ORCPT ); Fri, 5 May 2017 15:48:49 -0400 Received: from wuerfel.lan ([78.42.17.5]) by mrelayeu.kundenserver.de (mreue002 [212.227.15.129]) with ESMTPA (Nemesis) id 0LwAO6-1e7mvv1EBa-0181mV; Fri, 05 May 2017 21:48:33 +0200 From: Arnd Bergmann To: Ben Hutchings Cc: stable@vger.kernel.org, Juergen Gross , David Vrabel , Greg Kroah-Hartman , Arnd Bergmann Subject: [PATCH 3.16-stable 71/87] x86/xen: fix upper bound of pmd loop in xen_cleanhighmap() Date: Fri, 5 May 2017 21:47:29 +0200 Message-Id: <20170505194745.3627137-72-arnd@arndb.de> X-Mailer: git-send-email 2.9.0 In-Reply-To: <20170505194745.3627137-1-arnd@arndb.de> References: <20170505194745.3627137-1-arnd@arndb.de> X-Provags-ID: V03:K0:SaYuZXCOTN1gFmbC4MZsEUiCEF6l6VRjl9yJzVw9BWt+qR3KGk4 +GNYbK4+VOET/Mf4fJYUp/MznmIvoZNnFgxhwcIhBquIWOg6qBjRYBakdh+bJyWHmVe4iLs SqXtmTP1fk7/YM4DnOlj3kkLvFSk7hxgYHoWQPbPCOmIijGtSOR7/AWwnTImZtU8w8rh6KD wFuILdUw7kNNByKlddtpA== X-UI-Out-Filterresults: notjunk:1; V01:K0:rfqi6Hj6Su0=:aw8cM97Yl6v8353IlEiLzw yMTAL30tDvyItVord51KmE6jBgAZRxdgik5ZOdTEOHunFuN1sO2yEwQYIEkPQA4Dr1mpfJxcR 5nTrxHxBXxYskYl0DMmqfrIDC0Pc4ab6q5KHiHQVXE/9jKjsMcUwOiKw3gR7rUh5T+trQxGA7 Bv2k2I0Jgy9BhpsC/gSsDkJ70UDyKXlMCHnpQjJt5saekfMdOqw6SflmrKpeZDgFxMSn6Ncc8 JgccRHDuRhhOC9hNaAFT6aACMAmZz0XSP3dbm7uxYrbsCJZP8I0zOoYX1muLVXYgT1FaVYnKE W+7eI/7nL17+Cg6rXZKtghSip78XUkCsYEWz8x2BKY5ZW5aTS2FLaGl/kNLknI3Y+Rq38e8wP ZoyDY1m8qe4KQFlvsZ4unQEfwuQVnXN75VHC5p+M22rGyFGq3Dkyqa87O7ke36M7pAGOjXdbK 5XgDx6jos3BPhSPhCBM9tnBpHaUyiPAb7CURyGAAIyhSZLYyBsRrrSEcWyQ/Gzg12+au7VW1l nTvJHR44xe7g8JGI+TT/Hmw7JU2R1E+roJmjUwSRRbiIj1qi9vlCZ5BZmbhzgN9wMZzBkKPpq M1Lsi9GftJCK7tBgGwTkEeTrk/bGDoIwt9/CvDpCIoiJrRxKEZJyh2lgmbFLBrvHYh8CnH97V z+D06J39TWuqVuIYz3+unDc3vDaeP5z2vojR+VjBdOW4u8/np17PSYD78ajmzMBVcxCM= Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Juergen Gross commit 1cf38741308c64d08553602b3374fb39224eeb5a upstream. xen_cleanhighmap() is operating on level2_kernel_pgt only. The upper bound of the loop setting non-kernel-image entries to zero should not exceed the size of level2_kernel_pgt. Reported-by: Linus Torvalds Signed-off-by: Juergen Gross Signed-off-by: David Vrabel Signed-off-by: Greg Kroah-Hartman Signed-off-by: Arnd Bergmann --- arch/x86/xen/mmu.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) -- 2.9.0 diff --git a/arch/x86/xen/mmu.c b/arch/x86/xen/mmu.c index 16fb0099b7f2..f05f2d897a67 100644 --- a/arch/x86/xen/mmu.c +++ b/arch/x86/xen/mmu.c @@ -1187,7 +1187,7 @@ static void __init xen_cleanhighmap(unsigned long vaddr, /* NOTE: The loop is more greedy than the cleanup_highmap variant. * We include the PMD passed in on _both_ boundaries. */ - for (; vaddr <= vaddr_end && (pmd < (level2_kernel_pgt + PAGE_SIZE)); + for (; vaddr <= vaddr_end && (pmd < (level2_kernel_pgt + PTRS_PER_PMD)); pmd++, vaddr += PMD_SIZE) { if (pmd_none(*pmd)) continue;