lkml.org 
[lkml]   [2015]   [Mar]   [16]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 3.19 155/177] efi/libstub: Fix boundary checking in efi_high_alloc()
    Date
    3.19-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Yinghai Lu <yinghai@kernel.org>

    commit 7ed620bb343f434f8a85f830020c04988df2a140 upstream.

    While adding support loading kernel and initrd above 4G to grub2 in legacy
    mode, I was referring to efi_high_alloc().
    That will allocate buffer for kernel and then initrd, and initrd will
    use kernel buffer start as limit.

    During testing found two buffers will be overlapped when initrd size is
    very big like 400M.

    It turns out efi_high_alloc() boundary checking is not right.
    end - size will be the new start, and should not compare new
    start with max, we need to make sure end is smaller than max.

    [ Basically, with the current efi_high_alloc() code it's possible to
    allocate memory above 'max', because efi_high_alloc() doesn't check
    that the tail of the allocation is below 'max'.

    If you have an EFI memory map with a single entry that looks like so,

    [0xc0000000-0xc0004000]

    And want to allocate 0x3000 bytes below 0xc0003000 the current code
    will allocate [0xc0001000-0xc0004000], not [0xc0000000-0xc0003000]
    like you would expect. - Matt ]

    Signed-off-by: Yinghai Lu <yinghai@kernel.org>
    Reviewed-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
    Reviewed-by: Mark Rutland <mark.rutland@arm.com>
    Tested-by: Mark Rutland <mark.rutland@arm.com>
    Signed-off-by: Matt Fleming <matt.fleming@intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    drivers/firmware/efi/libstub/efi-stub-helper.c | 8 ++++----
    1 file changed, 4 insertions(+), 4 deletions(-)

    --- a/drivers/firmware/efi/libstub/efi-stub-helper.c
    +++ b/drivers/firmware/efi/libstub/efi-stub-helper.c
    @@ -170,12 +170,12 @@ again:
    start = desc->phys_addr;
    end = start + desc->num_pages * (1UL << EFI_PAGE_SHIFT);

    - if ((start + size) > end || (start + size) > max)
    - continue;
    -
    - if (end - size > max)
    + if (end > max)
    end = max;

    + if ((start + size) > end)
    + continue;
    +
    if (round_down(end - size, align) < start)
    continue;




    \
     
     \ /
      Last update: 2015-03-16 15:41    [W:4.047 / U:0.072 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site