1 files changed, 11 insertions, 0 deletions

diff --git a/arch/x86/kernel/ldt.c b/arch/x86/kernel/ldt.c
index ebc987398923..af1d14a9ebda 100644
--- a/arch/x86/kernel/ldt.c
+++ b/arch/x86/kernel/ldt.c
@@ -229,6 +229,17 @@ static int write_ldt(void __user *ptr, unsigned long bytecount, int oldmode)
                 }
         }
 
+        /*
+         * On x86-64 we do not support 16-bit segments due to
+         * IRET leaking the high bits of the kernel stack address.
+         */
+#ifdef CONFIG_X86_64
+        if (!ldt_info.seg_32bit) {
+                error = -EINVAL;
+                goto out_unlock;
+        }
+#endif
+
         fill_ldt(&ldt, &ldt_info);
         if (oldmode)
                 ldt.avl = 0;