Patch "x86/kexec: Allocate 8k PGDs for PTI" has been added to the 4.4-stable tree

This is a note to let you know that I've just added the patch titled

x86/kexec: Allocate 8k PGDs for PTI

to the 4.4-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
x86-kexec-allocate-8k-pgds-for-pti.patch
and it can be found in the queue-4.4 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

From: Joerg Roedel <[email protected]>
Date: Wed, 25 Jul 2018 17:48:03 +0200
Subject: x86/kexec: Allocate 8k PGDs for PTI

From: Joerg Roedel <[email protected]>

[ Upstream commit ca38dc8f2724d101038b1205122c93a1c7f38f11 ]

Fuzzing the PTI-x86-32 code with trinity showed unhandled kernel paging request oops-messages that looked a lot like silent data corruption.

Lot's of debugging and testing lead to the kexec-32bit code, which is still allocating 4k PGDs when PTI is enabled. But since it uses native_set_pud() to build the page-table, it will unevitably call into __pti_set_user_pgtbl(), which writes beyond the allocated 4k page.

Use PGD_ALLOCATION_ORDER to allocate PGDs in the kexec code to fix the issue.

---
 arch/x86/kernel/machine_kexec_32.c |    5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

@@ -70,7 +70,7 @@ static void load_segments(void)
 
 static void machine_kexec_free_page_tables(struct kimage *image)
 {
-	free_page((unsigned long)image->arch.pgd);
+	free_pages((unsigned long)image->arch.pgd, PGD_ALLOCATION_ORDER);
 	image->arch.pgd = NULL;
 #ifdef CONFIG_X86_PAE
 	free_page((unsigned long)image->arch.pmd0);

@@ -86,7 +86,8 @@ static void machine_kexec_free_page_tabl
 
 static int machine_kexec_alloc_page_tables(struct kimage *image)
 {
-	image->arch.pgd = (pgd_t *)get_zeroed_page(GFP_KERNEL);
+	image->arch.pgd = (pgd_t *)__get_free_pages(GFP_KERNEL | __GFP_ZERO,
+						    PGD_ALLOCATION_ORDER);
 #ifdef CONFIG_X86_PAE
 	image->arch.pmd0 = (pmd_t *)get_zeroed_page(GFP_KERNEL);
 	image->arch.pmd1 = (pmd_t *)get_zeroed_page(GFP_KERNEL);

Patches currently in stable-queue which might be from [email protected] are

queue-4.4/x86-kexec-allocate-8k-pgds-for-pti.patch queue-4.4/iommu-ipmmu-vmsa-fix-allocation-in-atomic-context.patch queue-4.4/x86-mm-remove-in_nmi-warning-from-vmalloc_fault.patch