Patch "x86/mpx: Fix 32-bit address space calculation" has been added to the 4.2-stable tree

This is a note to let you know that I've just added the patch titled

x86/mpx: Fix 32-bit address space calculation

to the 4.2-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
x86-mpx-fix-32-bit-address-space-calculation.patch
and it can be found in the queue-4.2 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

From: Dave Hansen <[email protected]>
Date: Wed, 11 Nov 2015 10:19:34 -0800
Subject: x86/mpx: Fix 32-bit address space calculation

From: Dave Hansen <[email protected]>

commit f3119b830264d89d216bfb378ab65065dffa02d9 upstream.

I received a bug report that running 32-bit MPX binaries on 64-bit kernels was broken. I traced it down to this little code snippet. We were switching our "number of bounds directory entries" calculation correctly. But, we didn't switch the other side of the calculation: the virtual space size.

This meant that we were calculating an absurd size for bd_entry_virt_space() on 32-bit because we used the 64-bit virt_space.

This was _also_ broken for 32-bit kernels running on 64-bit hardware since boot_cpu_data.x86_virt_bits=48 even when running in 32-bit mode.

Correct that and properly handle all 3 possible cases:

1. 32-bit binary on 64-bit kernel
2. 64-bit binary on 64-bit kernel
3. 32-bit binary on 32-bit kernel

This manifested in having bounds tables not properly unmapped. It "leaked" memory but had no functional impact otherwise.

---
 arch/x86/mm/mpx.c |   22 +++++++++++++++++-----
 1 file changed, 17 insertions(+), 5 deletions(-)

@@ -759,11 +759,23 @@ static unsigned long mpx_get_bt_entry_of
  */
 static inline unsigned long bd_entry_virt_space(struct mm_struct *mm)
 {
-	unsigned long long virt_space = (1ULL << boot_cpu_data.x86_virt_bits);
-	if (is_64bit_mm(mm))
-		return virt_space / MPX_BD_NR_ENTRIES_64;
-	else
-		return virt_space / MPX_BD_NR_ENTRIES_32;
+	unsigned long long virt_space;
+	unsigned long long GB = (1ULL << 30);
+
+	/*
+	 * This covers 32-bit emulation as well as 32-bit kernels
+	 * running on 64-bit harware.
+	 */
+	if (!is_64bit_mm(mm))
+		return (4ULL * GB) / MPX_BD_NR_ENTRIES_32;
+
+	/*
+	 * 'x86_virt_bits' returns what the hardware is capable
+	 * of, and returns the full >32-bit adddress space when
+	 * running 32-bit kernels on 64-bit hardware.
+	 */
+	virt_space = (1ULL << boot_cpu_data.x86_virt_bits);
+	return virt_space / MPX_BD_NR_ENTRIES_64;
 }
 
 /*

Patches currently in stable-queue which might be from [email protected] are

queue-4.2/x86-fpu-fix-get_xsave_addr-behavior-under-virtualization.patch queue-4.2/x86-mpx-do-proper-get_user-when-running-32-bit-binaries-on-64-bit-kernels.patch queue-4.2/x86-mpx-fix-32-bit-address-space-calculation.patch queue-4.2/x86-fpu-fix-32-bit-signal-frame-handling.patch