tree a162ba169f39ca272052cf503ff8045e8137513e
parent d27be51a92fcdd4c9aba90f0419a7c86a10018da
author Juergen Gross <jgross@suse.com> 1656573280 +0200
committer Meena Shanmugam <meenashanmugam@google.com> 1660706653 +0000

x86: Clear .brk area at early boot

[ Upstream commit 38fa5479b41376dc9d7f57e71c83514285a25ca0 ]

The .brk section has the same properties as .bss: it is an alloc-only
section and should be cleared before being used.

Not doing so is especially a problem for Xen PV guests, as the
hypervisor will validate page tables (check for writable page tables
and hypervisor private bits) before accepting them to be used.

Make sure .brk is initially zero by letting clear_bss() clear the brk
area, too.

BUG=b/241898227
TEST=presubmit
RELEASE_NOTE=Fixed CVE-2022-36123 in the Linux kernel.

Signed-off-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Borislav Petkov <bp@suse.de>
Link: https://lore.kernel.org/r/20220630071441.28576-3-jgross@suse.com
Signed-off-by: Sasha Levin <sashal@kernel.org>

cos-patch: security-moderate
Change-Id: I19bd20c3fc96f18078c5edeb798307c6ec0e1420
Reviewed-on: https://cos-review.googlesource.com/c/third_party/kernel/+/36068
Tested-by: Cusky Presubmit Bot <presubmit@cos-infra-prod.iam.gserviceaccount.com>
Reviewed-by: Robert Kolchmeyer <rkolchmeyer@google.com>