Files
linux/include/linux
Nicolai Stange 14d6c96674 x86/efi: Don't allocate memmap through memblock after mm_init()
commit 20b1e22d01 upstream.

With the following commit:

  4bc9f92e64 ("x86/efi-bgrt: Use efi_mem_reserve() to avoid copying image data")

...  efi_bgrt_init() calls into the memblock allocator through
efi_mem_reserve() => efi_arch_mem_reserve() *after* mm_init() has been called.

Indeed, KASAN reports a bad read access later on in efi_free_boot_services():

  BUG: KASAN: use-after-free in efi_free_boot_services+0xae/0x24c
            at addr ffff88022de12740
  Read of size 4 by task swapper/0/0
  page:ffffea0008b78480 count:0 mapcount:-127
  mapping:          (null) index:0x1 flags: 0x5fff8000000000()
  [...]
  Call Trace:
   dump_stack+0x68/0x9f
   kasan_report_error+0x4c8/0x500
   kasan_report+0x58/0x60
   __asan_load4+0x61/0x80
   efi_free_boot_services+0xae/0x24c
   start_kernel+0x527/0x562
   x86_64_start_reservations+0x24/0x26
   x86_64_start_kernel+0x157/0x17a
   start_cpu+0x5/0x14

The instruction at the given address is the first read from the memmap's
memory, i.e. the read of md->type in efi_free_boot_services().

Note that the writes earlier in efi_arch_mem_reserve() don't splat because
they're done through early_memremap()ed addresses.

So, after memblock is gone, allocations should be done through the "normal"
page allocator. Introduce a helper, efi_memmap_alloc() for this. Use
it from efi_arch_mem_reserve(), efi_free_boot_services() and, for the sake
of consistency, from efi_fake_memmap() as well.

Note that for the latter, the memmap allocations cease to be page aligned.
This isn't needed though.

Tested-by: Dan Williams <dan.j.williams@intel.com>
Signed-off-by: Nicolai Stange <nicstange@gmail.com>
Reviewed-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Cc: Dave Young <dyoung@redhat.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Matt Fleming <matt@codeblueprint.co.uk>
Cc: Mika Penttilä <mika.penttila@nextfour.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: linux-efi@vger.kernel.org
Fixes: 4bc9f92e64 ("x86/efi-bgrt: Use efi_mem_reserve() to avoid copying image data")
Link: http://lkml.kernel.org/r/20170105125130.2815-1-nicstange@gmail.com
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2017-01-19 20:18:00 +01:00
..
2015-10-07 18:08:15 +01:00
2016-03-04 23:50:27 -06:00
2016-07-08 16:23:11 +02:00
2016-11-11 23:23:02 +01:00
2015-03-25 20:28:11 -04:00
2016-08-25 11:26:48 -04:00
2016-09-14 09:18:06 -06:00
2016-06-07 13:41:38 -06:00
2016-09-29 01:35:35 -04:00
2016-08-11 09:41:35 -06:00
2016-09-27 21:20:53 -04:00
2016-08-02 19:35:24 -04:00
2016-10-07 18:46:30 -07:00
2016-09-16 09:34:15 +01:00
2016-06-07 13:41:38 -06:00
2016-05-17 15:48:12 -04:00
2016-10-30 13:09:42 -04:00
2016-09-16 12:44:20 +02:00
2016-07-22 09:07:02 +02:00
2016-09-24 10:48:18 +02:00
2015-05-05 13:40:42 -06:00
2015-11-25 09:22:00 -07:00
2016-02-11 09:59:22 -05:00
2016-10-20 15:51:28 +11:00
2016-09-16 09:34:15 +01:00
2016-09-14 09:18:09 -06:00
2016-09-20 23:20:32 +02:00
2016-05-11 22:37:54 +02:00
2015-06-25 12:06:45 +02:00
2016-01-28 14:19:12 -08:00
2016-03-22 15:36:02 -07:00
2016-08-10 11:23:44 -04:00
2016-03-22 15:36:02 -07:00
2015-07-28 08:50:42 +01:00
2016-01-15 17:56:32 -08:00
2016-09-15 16:49:39 +02:00
2015-04-29 17:17:17 -05:00
2016-09-14 12:57:43 -07:00
2016-09-27 12:33:47 +02:00
2015-06-24 17:49:41 -07:00
2016-08-04 10:16:55 +09:30
2015-07-21 10:39:05 -07:00
2016-07-29 12:17:52 -07:00
2016-08-28 23:32:41 -04:00
2016-06-03 19:37:21 -04:00
2016-04-25 15:09:11 -04:00
2016-02-16 13:04:58 -05:00
2016-10-19 11:36:22 -06:00
2016-05-02 09:00:56 -05:00
2017-01-12 11:39:36 +01:00
2016-11-23 16:23:23 -06:00
2015-04-12 21:03:31 +02:00
2016-02-11 18:35:48 -08:00
2016-03-14 15:43:11 -04:00
2016-10-14 11:36:59 -07:00
2016-07-12 19:25:38 -07:00
2016-09-27 21:52:00 -04:00
2015-10-06 17:08:19 +02:00
2016-09-08 15:01:10 -07:00
2016-09-08 15:01:10 -07:00
2016-03-17 15:09:34 -07:00
2016-07-06 10:51:14 +01:00
2016-09-20 04:43:36 -04:00
2016-03-22 15:36:02 -07:00
2016-07-26 16:19:19 -07:00
2016-09-08 22:15:25 -07:00
2016-06-14 10:54:40 -07:00
2016-01-04 16:11:11 -05:00
2016-09-06 18:30:20 +02:00
2016-08-28 23:44:55 -04:00
2016-05-08 23:46:14 -04:00
2016-10-05 18:23:36 -04:00
2017-01-19 20:17:59 +01:00
2015-06-25 17:00:39 -07:00
2016-09-21 00:23:00 -04:00
2016-06-20 12:47:15 -07:00
2015-10-01 09:57:59 -07:00
2016-07-19 17:43:38 +03:00
2016-05-23 17:04:14 -07:00
2016-04-07 16:53:29 -04:00
2015-11-23 09:44:58 +01:00
2016-07-26 16:19:19 -07:00
2016-05-20 17:58:30 -07:00
2016-02-22 16:10:08 -07:00
2016-06-25 09:04:48 -07:00
2016-09-30 10:54:03 +02:00
2015-12-03 07:24:29 -08:00
2015-03-24 09:48:14 -07:00
2016-08-29 08:13:21 -06:00
2015-09-08 15:35:28 -07:00