Patch "x86/xen: fix upper bound of pmd loop in xen_cleanhighmap()" has been added to the 4.4-stable tree

This is a note to let you know that I've just added the patch titled

    x86/xen: fix upper bound of pmd loop in xen_cleanhighmap()

to the 4.4-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     x86-xen-fix-upper-bound-of-pmd-loop-in-xen_cleanhighmap.patch
and it can be found in the queue-4.4 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let [off-list ref] know about it.

From 1cf38741308c64d08553602b3374fb39224eeb5a Mon Sep 17 00:00:00 2001

From: Juergen Gross <jgross@suse.com>
Date: Thu, 23 Jun 2016 07:12:27 +0200
Subject: x86/xen: fix upper bound of pmd loop in xen_cleanhighmap()

From: Juergen Gross <jgross@suse.com>

commit 1cf38741308c64d08553602b3374fb39224eeb5a upstream.

xen_cleanhighmap() is operating on level2_kernel_pgt only. The upper
bound of the loop setting non-kernel-image entries to zero should not
exceed the size of level2_kernel_pgt.

Reported-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Juergen Gross <jgross@suse.com>
Signed-off-by: David Vrabel <redacted>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/x86/xen/mmu.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/arch/x86/xen/mmu.c
+++ b/arch/x86/xen/mmu.c

@@ -1113,7 +1113,7 @@ static void __init xen_cleanhighmap(unsi
 
 	/* NOTE: The loop is more greedy than the cleanup_highmap variant.
 	 * We include the PMD passed in on _both_ boundaries. */
-	for (; vaddr <= vaddr_end && (pmd < (level2_kernel_pgt + PAGE_SIZE));
+	for (; vaddr <= vaddr_end && (pmd < (level2_kernel_pgt + PTRS_PER_PMD));
 			pmd++, vaddr += PMD_SIZE) {
 		if (pmd_none(*pmd))
 			continue;

Patches currently in stable-queue which might be from jgross@suse.com are

queue-4.4/x86-xen-fix-upper-bound-of-pmd-loop-in-xen_cleanhighmap.patch