diff options
| author | Nicolai Stange <nicstange@gmail.com> | 2017-01-05 07:51:29 -0500 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2017-01-19 14:18:00 -0500 |
| commit | 14d6c966744debbafd2f2815e052f2fed1dd154b (patch) | |
| tree | 35741cc02327d739cd2e4c2b030117c5f6430e5e /arch/x86 | |
| parent | 99b17ac0014be19906669dd51d26a78d14363d1f (diff) | |
x86/efi: Don't allocate memmap through memblock after mm_init()
commit 20b1e22d01a4b0b11d3a1066e9feb04be38607ec upstream.
With the following commit:
4bc9f92e64c8 ("x86/efi-bgrt: Use efi_mem_reserve() to avoid copying image data")
... efi_bgrt_init() calls into the memblock allocator through
efi_mem_reserve() => efi_arch_mem_reserve() *after* mm_init() has been called.
Indeed, KASAN reports a bad read access later on in efi_free_boot_services():
BUG: KASAN: use-after-free in efi_free_boot_services+0xae/0x24c
at addr ffff88022de12740
Read of size 4 by task swapper/0/0
page:ffffea0008b78480 count:0 mapcount:-127
mapping: (null) index:0x1 flags: 0x5fff8000000000()
[...]
Call Trace:
dump_stack+0x68/0x9f
kasan_report_error+0x4c8/0x500
kasan_report+0x58/0x60
__asan_load4+0x61/0x80
efi_free_boot_services+0xae/0x24c
start_kernel+0x527/0x562
x86_64_start_reservations+0x24/0x26
x86_64_start_kernel+0x157/0x17a
start_cpu+0x5/0x14
The instruction at the given address is the first read from the memmap's
memory, i.e. the read of md->type in efi_free_boot_services().
Note that the writes earlier in efi_arch_mem_reserve() don't splat because
they're done through early_memremap()ed addresses.
So, after memblock is gone, allocations should be done through the "normal"
page allocator. Introduce a helper, efi_memmap_alloc() for this. Use
it from efi_arch_mem_reserve(), efi_free_boot_services() and, for the sake
of consistency, from efi_fake_memmap() as well.
Note that for the latter, the memmap allocations cease to be page aligned.
This isn't needed though.
Tested-by: Dan Williams <dan.j.williams@intel.com>
Signed-off-by: Nicolai Stange <nicstange@gmail.com>
Reviewed-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Cc: Dave Young <dyoung@redhat.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Matt Fleming <matt@codeblueprint.co.uk>
Cc: Mika Penttilä <mika.penttila@nextfour.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: linux-efi@vger.kernel.org
Fixes: 4bc9f92e64c8 ("x86/efi-bgrt: Use efi_mem_reserve() to avoid copying image data")
Link: http://lkml.kernel.org/r/20170105125130.2815-1-nicstange@gmail.com
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'arch/x86')
| -rw-r--r-- | arch/x86/platform/efi/quirks.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/arch/x86/platform/efi/quirks.c b/arch/x86/platform/efi/quirks.c index 10aca63a50d7..30031d5293c4 100644 --- a/arch/x86/platform/efi/quirks.c +++ b/arch/x86/platform/efi/quirks.c | |||
| @@ -214,7 +214,7 @@ void __init efi_arch_mem_reserve(phys_addr_t addr, u64 size) | |||
| 214 | 214 | ||
| 215 | new_size = efi.memmap.desc_size * num_entries; | 215 | new_size = efi.memmap.desc_size * num_entries; |
| 216 | 216 | ||
| 217 | new_phys = memblock_alloc(new_size, 0); | 217 | new_phys = efi_memmap_alloc(num_entries); |
| 218 | if (!new_phys) { | 218 | if (!new_phys) { |
| 219 | pr_err("Could not allocate boot services memmap\n"); | 219 | pr_err("Could not allocate boot services memmap\n"); |
| 220 | return; | 220 | return; |
| @@ -355,7 +355,7 @@ void __init efi_free_boot_services(void) | |||
| 355 | } | 355 | } |
| 356 | 356 | ||
| 357 | new_size = efi.memmap.desc_size * num_entries; | 357 | new_size = efi.memmap.desc_size * num_entries; |
| 358 | new_phys = memblock_alloc(new_size, 0); | 358 | new_phys = efi_memmap_alloc(num_entries); |
| 359 | if (!new_phys) { | 359 | if (!new_phys) { |
| 360 | pr_err("Failed to allocate new EFI memmap\n"); | 360 | pr_err("Failed to allocate new EFI memmap\n"); |
| 361 | return; | 361 | return; |