From: Ard Biesheuvel <ard.biesheuvel@linaro.org>
To: Gen Zhang <blackgod016574@gmail.com>
Cc: Darren Hart <dvhart@infradead.org>,
linux-efi <linux-efi@vger.kernel.org>,
Linux Kernel Mailing List <linux-kernel@vger.kernel.org>
Subject: Re: [PATCH v2] efi_64: Fix a missing-check bug in arch/x86/platform/efi/efi_64.c
Date: Fri, 24 May 2019 18:07:10 +0200 [thread overview]
Message-ID: <CAKv+Gu_wRYZdDYXso0B5m_BPJznGQXpCWq4_0u34bConu0V1ow@mail.gmail.com> (raw)
In-Reply-To: <20190523005133.GA14881@zhanggen-UX430UQ>
On Thu, 23 May 2019 at 02:51, Gen Zhang <blackgod016574@gmail.com> wrote:
>
> In efi_call_phys_prolog(), save_pgd is allocated by kmalloc_array().
> And it is dereferenced in the following codes. However, memory
> allocation functions such as kmalloc_array() may fail. Dereferencing
> this save_pgd null pointer may cause the kernel go wrong. Thus we
> should check this allocation.
> Further, if efi_call_phys_prolog() returns NULL, we should abort the
> process in phys_efi_set_virtual_address_map(), and return EFI_ABORTED.
>
> Signed-off-by: Gen Zhang <blackgod016574@gmail.com>
>
> ---
> diff --git a/arch/x86/platform/efi/efi.c b/arch/x86/platform/efi/efi.c
> index e1cb01a..a7189a3 100644
> --- a/arch/x86/platform/efi/efi.c
> +++ b/arch/x86/platform/efi/efi.c
> @@ -85,6 +85,8 @@ static efi_status_t __init phys_efi_set_virtual_address_map(
> pgd_t *save_pgd;
>
> save_pgd = efi_call_phys_prolog();
> + if (!save_pgd)
> + return EFI_ABORTED;
>
> /* Disable interrupts around EFI calls: */
> local_irq_save(flags);
> diff --git a/arch/x86/platform/efi/efi_64.c b/arch/x86/platform/efi/efi_64.c
> index cf0347f..828460a 100644
> --- a/arch/x86/platform/efi/efi_64.c
> +++ b/arch/x86/platform/efi/efi_64.c
> @@ -91,6 +91,8 @@ pgd_t * __init efi_call_phys_prolog(void)
>
> n_pgds = DIV_ROUND_UP((max_pfn << PAGE_SHIFT), PGDIR_SIZE);
> save_pgd = kmalloc_array(n_pgds, sizeof(*save_pgd), GFP_KERNEL);
> + if (!save_pgd)
> + return NULL;
>
> /*
> * Build 1:1 identity mapping for efi=old_map usage. Note that
> ---
Apologies for only spotting this now, but I seem to have given some bad advice.
efi_call_phys_prolog() in efi_64.c will also return NULL if
(!efi_enabled(EFI_OLD_MEMMAP)), but this is not an error condition. So
that occurrence has to be updated: please return efi_mm.pgd instead.
next prev parent reply other threads:[~2019-05-24 16:07 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <20190517082633.GA3890@zhanggen-UX430UQ>
2019-05-17 8:41 ` [PATCH] efi_64: Fix a missing-check bug in arch/x86/platform/efi/efi_64.c of Linux 5.1 Ard Biesheuvel
[not found] ` <20190517090628.GA4162@zhanggen-UX430UQ>
2019-05-17 9:24 ` Ard Biesheuvel
2019-05-17 9:43 ` Gen Zhang
2019-05-23 0:51 ` [PATCH v2] efi_64: Fix a missing-check bug in arch/x86/platform/efi/efi_64.c Gen Zhang
2019-05-24 16:07 ` Ard Biesheuvel [this message]
2019-05-25 2:36 ` Gen Zhang
2019-05-25 9:18 ` Ard Biesheuvel
2019-05-25 9:40 ` Gen Zhang
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=CAKv+Gu_wRYZdDYXso0B5m_BPJznGQXpCWq4_0u34bConu0V1ow@mail.gmail.com \
--to=ard.biesheuvel@linaro.org \
--cc=blackgod016574@gmail.com \
--cc=dvhart@infradead.org \
--cc=linux-efi@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).