lkml.org 
[lkml]   [2020]   [Feb]   [21]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.19 028/191] efi/x86: Map the entire EFI vendor string before copying it
    Date
    From: Ard Biesheuvel <ardb@kernel.org>

    [ Upstream commit ffc2760bcf2dba0dbef74013ed73eea8310cc52c ]

    Fix a couple of issues with the way we map and copy the vendor string:
    - we map only 2 bytes, which usually works since you get at least a
    page, but if the vendor string happens to cross a page boundary,
    a crash will result
    - only call early_memunmap() if early_memremap() succeeded, or we will
    call it with a NULL address which it doesn't like,
    - while at it, switch to early_memremap_ro(), and array indexing rather
    than pointer dereferencing to read the CHAR16 characters.

    Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
    Cc: Andy Lutomirski <luto@kernel.org>
    Cc: Ard Biesheuvel <ard.biesheuvel@linaro.org>
    Cc: Arvind Sankar <nivedita@alum.mit.edu>
    Cc: Matthew Garrett <mjg59@google.com>
    Cc: linux-efi@vger.kernel.org
    Fixes: 5b83683f32b1 ("x86: EFI runtime service support")
    Link: https://lkml.kernel.org/r/20200103113953.9571-5-ardb@kernel.org
    Signed-off-by: Ingo Molnar <mingo@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    arch/x86/platform/efi/efi.c | 13 +++++++------
    1 file changed, 7 insertions(+), 6 deletions(-)

    diff --git a/arch/x86/platform/efi/efi.c b/arch/x86/platform/efi/efi.c
    index 335a62e74a2e9..5b0275310070e 100644
    --- a/arch/x86/platform/efi/efi.c
    +++ b/arch/x86/platform/efi/efi.c
    @@ -480,7 +480,6 @@ void __init efi_init(void)
    efi_char16_t *c16;
    char vendor[100] = "unknown";
    int i = 0;
    - void *tmp;

    #ifdef CONFIG_X86_32
    if (boot_params.efi_info.efi_systab_hi ||
    @@ -505,14 +504,16 @@ void __init efi_init(void)
    /*
    * Show what we know for posterity
    */
    - c16 = tmp = early_memremap(efi.systab->fw_vendor, 2);
    + c16 = early_memremap_ro(efi.systab->fw_vendor,
    + sizeof(vendor) * sizeof(efi_char16_t));
    if (c16) {
    - for (i = 0; i < sizeof(vendor) - 1 && *c16; ++i)
    - vendor[i] = *c16++;
    + for (i = 0; i < sizeof(vendor) - 1 && c16[i]; ++i)
    + vendor[i] = c16[i];
    vendor[i] = '\0';
    - } else
    + early_memunmap(c16, sizeof(vendor) * sizeof(efi_char16_t));
    + } else {
    pr_err("Could not map the firmware vendor!\n");
    - early_memunmap(tmp, 2);
    + }

    pr_info("EFI v%u.%.02u by %s\n",
    efi.systab->hdr.revision >> 16,
    --
    2.20.1


    \
     
     \ /
      Last update: 2020-02-21 09:30    [W:3.103 / U:0.040 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site