save_pgd is allocated by kmalloc_array. And it is dereferenced in the
following codes. However, memory allocation functions such as
kmalloc_array may fail. Dereferencing this save_pgd null pointer may
cause the kernel go wrong. Thus we should check this allocation and add
error handling code.
Signed-off-by: Gen Zhang <[email protected]>
---
diff --git a/arch/x86/platform/efi/efi_64.c b/arch/x86/platform/efi/efi_64.c
index cf0347f..fb9ae57 100644
--- a/arch/x86/platform/efi/efi_64.c
+++ b/arch/x86/platform/efi/efi_64.c
@@ -91,6 +91,8 @@ pgd_t * __init efi_call_phys_prolog(void)
n_pgds = DIV_ROUND_UP((max_pfn << PAGE_SHIFT), PGDIR_SIZE);
save_pgd = kmalloc_array(n_pgds, sizeof(*save_pgd), GFP_KERNEL);
+ if (!save_pgd)
+ goto err;
/*
* Build 1:1 identity mapping for efi=old_map usage. Note that
@@ -142,6 +144,9 @@ pgd_t * __init efi_call_phys_prolog(void)
__flush_tlb_all();
return save_pgd;
+err:
+ __flush_tlb_all();
+ return ERR_PTR(-ENOMEM);
}
void __init efi_call_phys_epilog(pgd_t *save_pgd)
---
On Fri, 17 May 2019 at 11:06, Gen Zhang <[email protected]> wrote:
>
> On Fri, May 17, 2019 at 10:41:28AM +0200, Ard Biesheuvel wrote:
> > Returning an error here is not going to make much difference, given
> > that the caller of efi_call_phys_prolog() does not bother to check it,
> > and passes the result straight into efi_call_phys_epilog(), which
> > happily attempts to dereference it.
> >
> > So if you want to fix this properly, please fix it at the call site as
> > well. I'd prefer to avoid ERR_PTR() and just return NULL for a failed
> > allocation though.
> Hi Ard,
> Thanks for your timely reply!
> I think returning NULL in efi_call_phys_prolog() and checking in
> efi_call_phys_epilog() is much better. But I am confused what to return
> in efi_call_phys_epilog() if save_pgd is NULL. Definitely not return
> -ENOMEM, because efi_call_phys_epilog() returns unsigned long. Could
> please light on me to fix this problem?
If efi_call_phys_prolog() returns NULL, the calling function should
abort and never call efi_call_phys_epilog().
On Fri, May 17, 2019 at 11:24:27AM +0200, Ard Biesheuvel wrote:
> If efi_call_phys_prolog() returns NULL, the calling function should
> abort and never call efi_call_phys_epilog().
Hi Ard,
I edit the patch and it is as following. Returning EFI_ABORTED would
be proper, because the return value (status) is checked in
__efi_enter_virtual_mode(). And returning EFI_ABORTED can abort the
process.
Thanks
Gen
save_pgd is allocated by kmalloc_array. And it is dereferenced in the
following codes. However, memory allocation functions such as
kmalloc_array may fail. Dereferencing this save_pgd null pointer may
cause the kernel go wrong. Thus we should check this allocation.
Signed-off-by: Gen Zhang <[email protected]>
---
diff --git a/arch/x86/platform/efi/efi.c b/arch/x86/platform/efi/efi.c
index e1cb01a..a7189a3 100644
--- a/arch/x86/platform/efi/efi.c
+++ b/arch/x86/platform/efi/efi.c
@@ -85,6 +85,8 @@ static efi_status_t __init phys_efi_set_virtual_address_map(
pgd_t *save_pgd;
save_pgd = efi_call_phys_prolog();
+ if (!save_pgd)
+ return EFI_ABORTED;
/* Disable interrupts around EFI calls: */
local_irq_save(flags);
diff --git a/arch/x86/platform/efi/efi_64.c b/arch/x86/platform/efi/efi_64.c
index cf0347f..828460a 100644
--- a/arch/x86/platform/efi/efi_64.c
+++ b/arch/x86/platform/efi/efi_64.c
@@ -91,6 +91,8 @@ pgd_t * __init efi_call_phys_prolog(void)
n_pgds = DIV_ROUND_UP((max_pfn << PAGE_SHIFT), PGDIR_SIZE);
save_pgd = kmalloc_array(n_pgds, sizeof(*save_pgd), GFP_KERNEL);
+ if (!save_pgd)
+ return NULL;
/*
* Build 1:1 identity mapping for efi=old_map usage. Note that
---
Hello Gen,
Thanks for the patch.
On Fri, 17 May 2019 at 10:26, Gen Zhang <[email protected]> wrote:
>
> save_pgd is allocated by kmalloc_array. And it is dereferenced in the
> following codes. However, memory allocation functions such as
> kmalloc_array may fail. Dereferencing this save_pgd null pointer may
> cause the kernel go wrong. Thus we should check this allocation and add
> error handling code.
>
> Signed-off-by: Gen Zhang <[email protected]>
>
> ---
> diff --git a/arch/x86/platform/efi/efi_64.c b/arch/x86/platform/efi/efi_64.c
> index cf0347f..fb9ae57 100644
> --- a/arch/x86/platform/efi/efi_64.c
> +++ b/arch/x86/platform/efi/efi_64.c
> @@ -91,6 +91,8 @@ pgd_t * __init efi_call_phys_prolog(void)
>
> n_pgds = DIV_ROUND_UP((max_pfn << PAGE_SHIFT), PGDIR_SIZE);
> save_pgd = kmalloc_array(n_pgds, sizeof(*save_pgd), GFP_KERNEL);
> + if (!save_pgd)
> + goto err;
>
> /*
> * Build 1:1 identity mapping for efi=old_map usage. Note that
> @@ -142,6 +144,9 @@ pgd_t * __init efi_call_phys_prolog(void)
> __flush_tlb_all();
>
> return save_pgd;
> +err:
> + __flush_tlb_all();
What is the point of the goto and the TLB flush?
> + return ERR_PTR(-ENOMEM);
Returning an error here is not going to make much difference, given
that the caller of efi_call_phys_prolog() does not bother to check it,
and passes the result straight into efi_call_phys_epilog(), which
happily attempts to dereference it.
So if you want to fix this properly, please fix it at the call site as
well. I'd prefer to avoid ERR_PTR() and just return NULL for a failed
allocation though.
> }
>
> void __init efi_call_phys_epilog(pgd_t *save_pgd)
> ---
On Fri, May 17, 2019 at 10:41:28AM +0200, Ard Biesheuvel wrote:
> Returning an error here is not going to make much difference, given
> that the caller of efi_call_phys_prolog() does not bother to check it,
> and passes the result straight into efi_call_phys_epilog(), which
> happily attempts to dereference it.
>
> So if you want to fix this properly, please fix it at the call site as
> well. I'd prefer to avoid ERR_PTR() and just return NULL for a failed
> allocation though.
Hi Ard,
Thanks for your timely reply!
I think returning NULL in efi_call_phys_prolog() and checking in
efi_call_phys_epilog() is much better. But I am confused what to return
in efi_call_phys_epilog() if save_pgd is NULL. Definitely not return
-ENOMEM, because efi_call_phys_epilog() returns unsigned long. Could
please light on me to fix this problem?
Thanks
Gen
On Fri, May 17, 2019 at 11:24:27AM +0200, Ard Biesheuvel wrote:
> On Fri, 17 May 2019 at 11:06, Gen Zhang <[email protected]> wrote:
> >
> > On Fri, May 17, 2019 at 10:41:28AM +0200, Ard Biesheuvel wrote:
> > > Returning an error here is not going to make much difference, given
> > > that the caller of efi_call_phys_prolog() does not bother to check it,
> > > and passes the result straight into efi_call_phys_epilog(), which
> > > happily attempts to dereference it.
> > >
> > > So if you want to fix this properly, please fix it at the call site as
> > > well. I'd prefer to avoid ERR_PTR() and just return NULL for a failed
> > > allocation though.
> > Hi Ard,
> > Thanks for your timely reply!
> > I think returning NULL in efi_call_phys_prolog() and checking in
> > efi_call_phys_epilog() is much better. But I am confused what to return
> > in efi_call_phys_epilog() if save_pgd is NULL. Definitely not return
> > -ENOMEM, because efi_call_phys_epilog() returns unsigned long. Could
> > please light on me to fix this problem?
>
>
> If efi_call_phys_prolog() returns NULL, the calling function should
> abort and never call efi_call_phys_epilog().
In efi_call_phys_prolog(), save_pgd is allocated by kmalloc_array().
And it is dereferenced in the following codes. However, memory
allocation functions such as kmalloc_array() may fail. Dereferencing
this save_pgd null pointer may cause the kernel go wrong. Thus we
should check this allocation.
Further, if efi_call_phys_prolog() returns NULL, we should abort the
process in phys_efi_set_virtual_address_map(), and return EFI_ABORTED.
Signed-off-by: Gen Zhang <[email protected]>
---
diff --git a/arch/x86/platform/efi/efi.c b/arch/x86/platform/efi/efi.c
index e1cb01a..a7189a3 100644
--- a/arch/x86/platform/efi/efi.c
+++ b/arch/x86/platform/efi/efi.c
@@ -85,6 +85,8 @@ static efi_status_t __init phys_efi_set_virtual_address_map(
pgd_t *save_pgd;
save_pgd = efi_call_phys_prolog();
+ if (!save_pgd)
+ return EFI_ABORTED;
/* Disable interrupts around EFI calls: */
local_irq_save(flags);
diff --git a/arch/x86/platform/efi/efi_64.c b/arch/x86/platform/efi/efi_64.c
index cf0347f..828460a 100644
--- a/arch/x86/platform/efi/efi_64.c
+++ b/arch/x86/platform/efi/efi_64.c
@@ -91,6 +91,8 @@ pgd_t * __init efi_call_phys_prolog(void)
n_pgds = DIV_ROUND_UP((max_pfn << PAGE_SHIFT), PGDIR_SIZE);
save_pgd = kmalloc_array(n_pgds, sizeof(*save_pgd), GFP_KERNEL);
+ if (!save_pgd)
+ return NULL;
/*
* Build 1:1 identity mapping for efi=old_map usage. Note that
---
In efi_call_phys_prolog(), save_pgd is allocated by kmalloc_array().
And it is dereferenced in the following codes. However, memory
allocation functions such as kmalloc_array() may fail. Dereferencing
this save_pgd null pointer may cause the kernel go wrong. Thus we
should check this allocation.
Further, if efi_call_phys_prolog() returns NULL, we should abort the
process in phys_efi_set_virtual_address_map(), and return EFI_ABORTED.
Signed-off-by: Gen Zhang <[email protected]>
---
diff --git a/arch/x86/platform/efi/efi.c b/arch/x86/platform/efi/efi.c
index e1cb01a..a7189a3 100644
--- a/arch/x86/platform/efi/efi.c
+++ b/arch/x86/platform/efi/efi.c
@@ -85,6 +85,8 @@ static efi_status_t __init phys_efi_set_virtual_address_map(
pgd_t *save_pgd;
save_pgd = efi_call_phys_prolog();
+ if (!save_pgd)
+ return EFI_ABORTED;
/* Disable interrupts around EFI calls: */
local_irq_save(flags);
diff --git a/arch/x86/platform/efi/efi_64.c b/arch/x86/platform/efi/efi_64.c
index cf0347f..828460a 100644
--- a/arch/x86/platform/efi/efi_64.c
+++ b/arch/x86/platform/efi/efi_64.c
@@ -91,6 +91,8 @@ pgd_t * __init efi_call_phys_prolog(void)
n_pgds = DIV_ROUND_UP((max_pfn << PAGE_SHIFT), PGDIR_SIZE);
save_pgd = kmalloc_array(n_pgds, sizeof(*save_pgd), GFP_KERNEL);
+ if (!save_pgd)
+ return NULL;
/*
* Build 1:1 identity mapping for efi=old_map usage. Note that
---
On Thu, 23 May 2019 at 02:51, Gen Zhang <[email protected]> wrote:
>
> In efi_call_phys_prolog(), save_pgd is allocated by kmalloc_array().
> And it is dereferenced in the following codes. However, memory
> allocation functions such as kmalloc_array() may fail. Dereferencing
> this save_pgd null pointer may cause the kernel go wrong. Thus we
> should check this allocation.
> Further, if efi_call_phys_prolog() returns NULL, we should abort the
> process in phys_efi_set_virtual_address_map(), and return EFI_ABORTED.
>
> Signed-off-by: Gen Zhang <[email protected]>
>
> ---
> diff --git a/arch/x86/platform/efi/efi.c b/arch/x86/platform/efi/efi.c
> index e1cb01a..a7189a3 100644
> --- a/arch/x86/platform/efi/efi.c
> +++ b/arch/x86/platform/efi/efi.c
> @@ -85,6 +85,8 @@ static efi_status_t __init phys_efi_set_virtual_address_map(
> pgd_t *save_pgd;
>
> save_pgd = efi_call_phys_prolog();
> + if (!save_pgd)
> + return EFI_ABORTED;
>
> /* Disable interrupts around EFI calls: */
> local_irq_save(flags);
> diff --git a/arch/x86/platform/efi/efi_64.c b/arch/x86/platform/efi/efi_64.c
> index cf0347f..828460a 100644
> --- a/arch/x86/platform/efi/efi_64.c
> +++ b/arch/x86/platform/efi/efi_64.c
> @@ -91,6 +91,8 @@ pgd_t * __init efi_call_phys_prolog(void)
>
> n_pgds = DIV_ROUND_UP((max_pfn << PAGE_SHIFT), PGDIR_SIZE);
> save_pgd = kmalloc_array(n_pgds, sizeof(*save_pgd), GFP_KERNEL);
> + if (!save_pgd)
> + return NULL;
>
> /*
> * Build 1:1 identity mapping for efi=old_map usage. Note that
> ---
Apologies for only spotting this now, but I seem to have given some bad advice.
efi_call_phys_prolog() in efi_64.c will also return NULL if
(!efi_enabled(EFI_OLD_MEMMAP)), but this is not an error condition. So
that occurrence has to be updated: please return efi_mm.pgd instead.
On Fri, May 24, 2019 at 06:07:10PM +0200, Ard Biesheuvel wrote:
> Apologies for only spotting this now, but I seem to have given some bad advice.
>
> efi_call_phys_prolog() in efi_64.c will also return NULL if
> (!efi_enabled(EFI_OLD_MEMMAP)), but this is not an error condition. So
> that occurrence has to be updated: please return efi_mm.pgd instead.
Thanks for your reply, Ard. You mean that we should return efi_mm.pgd
when allcoation fails? And we should delete return EFI_ABORTED on the
caller site, right? In that case, how should we handle the NULL pointer
returned by condition if(!efi_enabled(EFI_OLD_MEMMAP)) on the caller
site?
Thanks
Gen
On Sat, 25 May 2019 at 04:36, Gen Zhang <[email protected]> wrote:
>
> On Fri, May 24, 2019 at 06:07:10PM +0200, Ard Biesheuvel wrote:
> > Apologies for only spotting this now, but I seem to have given some bad advice.
> >
> > efi_call_phys_prolog() in efi_64.c will also return NULL if
> > (!efi_enabled(EFI_OLD_MEMMAP)), but this is not an error condition. So
> > that occurrence has to be updated: please return efi_mm.pgd instead.
> Thanks for your reply, Ard. You mean that we should return efi_mm.pgd
> when allcoation fails? And we should delete return EFI_ABORTED on the
> caller site, right? In that case, how should we handle the NULL pointer
> returned by condition if(!efi_enabled(EFI_OLD_MEMMAP)) on the caller
> site?
>
No, the other way around. I have already updated the patch, so don't
worry about it.
https://git.kernel.org/pub/scm/linux/kernel/git/efi/efi.git/commit/?h=urgent&id=d2dc2bc7b60b936b95da4b04c2912c02974c3e9f
On Sat, May 25, 2019 at 11:18:36AM +0200, Ard Biesheuvel wrote:
> On Sat, 25 May 2019 at 04:36, Gen Zhang <[email protected]> wrote:
> >
> > On Fri, May 24, 2019 at 06:07:10PM +0200, Ard Biesheuvel wrote:
> > > Apologies for only spotting this now, but I seem to have given some bad advice.
> > >
> > > efi_call_phys_prolog() in efi_64.c will also return NULL if
> > > (!efi_enabled(EFI_OLD_MEMMAP)), but this is not an error condition. So
> > > that occurrence has to be updated: please return efi_mm.pgd instead.
> > Thanks for your reply, Ard. You mean that we should return efi_mm.pgd
> > when allcoation fails? And we should delete return EFI_ABORTED on the
> > caller site, right? In that case, how should we handle the NULL pointer
> > returned by condition if(!efi_enabled(EFI_OLD_MEMMAP)) on the caller
> > site?
> >
>
> No, the other way around. I have already updated the patch, so don't
> worry about it.
>
> https://git.kernel.org/pub/scm/linux/kernel/git/efi/efi.git/commit/?h=urgent&id=d2dc2bc7b60b936b95da4b04c2912c02974c3e9f
Thanks for your reply and update, Ard! That's really nice of you.
Thanks
Gen