Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753482AbbBTESl (ORCPT ); Thu, 19 Feb 2015 23:18:41 -0500 Received: from aserp1040.oracle.com ([141.146.126.69]:34954 "EHLO aserp1040.oracle.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752018AbbBTESk (ORCPT ); Thu, 19 Feb 2015 23:18:40 -0500 From: Yinghai Lu To: Matt Fleming , "H. Peter Anvin" Cc: Ard Biesheuvel , Leif Lindholm , Roy Franz , Mark Rutland , linux-efi@vger.kernel.org, linux-kernel@vger.kernel.org, Yinghai Lu Subject: [PATCH] efi: fix boundary checking in efi_high_alloc() Date: Thu, 19 Feb 2015 20:18:03 -0800 Message-Id: <1424405883-19842-1-git-send-email-yinghai@kernel.org> X-Mailer: git-send-email 1.8.4.5 X-Source-IP: ucsinet22.oracle.com [156.151.31.94] Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1527 Lines: 44 While adding support loading kernel and initrd above 4G to grub2 in legacy mode, I was referring to efi_high_alloc(). That will allocate buffer for kernel and then initrd, and initrd will use kernel buffer start as limit. During testing found two buffers will be overlapped when initrd size is very big like 400M. It turns out efi_high_alloc() boundary checking is not right. end - size will be the new start, and should not compare new start with max, we need to make sure end is smaller than max. Signed-off-by: Yinghai Lu --- drivers/firmware/efi/libstub/efi-stub-helper.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) Index: linux-2.6/drivers/firmware/efi/libstub/efi-stub-helper.c =================================================================== --- linux-2.6.orig/drivers/firmware/efi/libstub/efi-stub-helper.c +++ linux-2.6/drivers/firmware/efi/libstub/efi-stub-helper.c @@ -183,12 +183,12 @@ again: start = desc->phys_addr; end = start + desc->num_pages * (1UL << EFI_PAGE_SHIFT); - if ((start + size) > end || (start + size) > max) - continue; - - if (end - size > max) + if (end > max) end = max; + if ((start + size) > end) + continue; + if (round_down(end - size, align) < start) continue; -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/