From 29a5f3fc8072011c09c5a97d3e2aed323b08a82c Mon Sep 17 00:00:00 2001
From: Jiri Slaby <jslaby@suse.cz>
Date: Apr 20 2023 07:11:12 +0000
Subject: x86/pkeys: Add check for pkey "overflow" (git-fixes).


---

diff --git a/patches.suse/x86-pkeys-Add-check-for-pkey-overflow.patch b/patches.suse/x86-pkeys-Add-check-for-pkey-overflow.patch
new file mode 100644
index 0000000..ee22177
--- /dev/null
+++ b/patches.suse/x86-pkeys-Add-check-for-pkey-overflow.patch
@@ -0,0 +1,71 @@
+From: Dave Hansen <dave.hansen@linux.intel.com>
+Date: Wed, 22 Jan 2020 08:53:46 -0800
+Subject: x86/pkeys: Add check for pkey "overflow"
+Git-commit: 16171bffc829272d5e6014bad48f680cb50943d9
+Patch-mainline: 5.7-rc1
+References: git-fixes
+
+Alex Shi reported the pkey macros above arch_set_user_pkey_access()
+to be unused.  They are unused, and even refer to a nonexistent
+CONFIG option.
+
+But, they might have served a good use, which was to ensure that
+the code does not try to set values that would not fit in the
+PKRU register.  As it stands, a too-large 'pkey' value would
+be likely to silently overflow the u32 new_pkru_bits.
+
+Add a check to look for overflows.  Also add a comment to remind
+any future developer to closely examine the types used to store
+pkey values if arch_max_pkey() ever changes.
+
+This boots and passes the x86 pkey selftests.
+
+Reported-by: Alex Shi <alex.shi@linux.alibaba.com>
+Signed-off-by: Dave Hansen <dave.hansen@intel.com>
+Signed-off-by: Borislav Petkov <bp@suse.de>
+Link: https://lkml.kernel.org/r/20200122165346.AD4DA150@viggo.jf.intel.com
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ arch/x86/include/asm/pkeys.h |    5 +++++
+ arch/x86/kernel/fpu/xstate.c |    9 +++++++--
+ 2 files changed, 12 insertions(+), 2 deletions(-)
+
+--- a/arch/x86/include/asm/pkeys.h
++++ b/arch/x86/include/asm/pkeys.h
+@@ -3,6 +3,11 @@
+ 
+ #define ARCH_DEFAULT_PKEY	0
+ 
++/*
++ * If more than 16 keys are ever supported, a thorough audit
++ * will be necessary to ensure that the types that store key
++ * numbers and masks have sufficient capacity.
++ */
+ #define arch_max_pkey() (boot_cpu_has(X86_FEATURE_OSPKE) ? 16 : 1)
+ 
+ extern int arch_set_user_pkey_access(struct task_struct *tsk, int pkey,
+--- a/arch/x86/kernel/fpu/xstate.c
++++ b/arch/x86/kernel/fpu/xstate.c
+@@ -885,8 +885,6 @@ const void *get_xsave_field_ptr(int xsav
+ 
+ #ifdef CONFIG_ARCH_HAS_PKEYS
+ 
+-#define NR_VALID_PKRU_BITS (CONFIG_NR_PROTECTION_KEYS * 2)
+-#define PKRU_VALID_MASK (NR_VALID_PKRU_BITS - 1)
+ /*
+  * This will go out and modify PKRU register to set the access
+  * rights for @pkey to @init_val.
+@@ -905,6 +903,13 @@ int arch_set_user_pkey_access(struct tas
+ 	if (!boot_cpu_has(X86_FEATURE_OSPKE))
+ 		return -EINVAL;
+ 
++	/*
++	 * This code should only be called with valid 'pkey'
++	 * values originating from in-kernel users.  Complain
++	 * if a bad value is observed.
++	 */
++	WARN_ON_ONCE(pkey >= arch_max_pkey());
++
+ 	/* Set the bits we need in PKRU:  */
+ 	if (init_val & PKEY_DISABLE_ACCESS)
+ 		new_pkru_bits |= PKRU_AD_BIT;
diff --git a/series.conf b/series.conf
index 9a77fe5..13e18e6 100644
--- a/series.conf
+++ b/series.conf
@@ -55741,6 +55741,7 @@
 	patches.suse/fbdev-g364fb-Fix-build-failure.patch
 	patches.suse/firmware-arm_sdei-fix-double-lock-on-hibernate-with-.patch
 	patches.suse/firmware-arm_sdei-fix-possible-double-lock-on-hibern.patch
+	patches.suse/x86-pkeys-Add-check-for-pkey-overflow.patch
 	patches.suse/btrfs-use-btrfs_ordered_update_i_size-in-clone_finish_inode_update.patch
 	patches.suse/btrfs-introduce-per-inode-file-extent-tree.patch
 	patches.suse/btrfs-use-the-file-extent-tree-infrastructure.patch