Date: Sat, 30 Apr 2016 21:08:44 +0100
From: Matt Fleming <matt@codeblueprint.co.uk>
To: "Compostella, Jeremy" <jeremy.compostella@intel.com>
Cc: Ingo Molnar <mingo@kernel.org>, stefan.stanacar@intel.com,
        peterz@infradead.org, linux-kernel@vger.kernel.org, tglx@linutronix.de,
        hpa@zytor.com, bp@alien8.de, ard.biesheuvel@linaro.org,
        linux-tip-commits@vger.kernel.org
Subject: Re: [tip:efi/core] efibc: Add EFI Bootloader Control module
Message-ID: <20160430200844.GK2839@codeblueprint.co.uk>
References: <1461614832-17633-26-git-send-email-matt@codeblueprint.co.uk>
 <tip-06f7d4a1618dbb086e738c93cd1ef416ab01027d@git.kernel.org>
 <20160429095356.GA29957@gmail.com>
 <20160429103011.GE2839@codeblueprint.co.uk>
 <87lh3wejfi.fsf@jcompost-MOBL1.tl.intel.com>
 <20160429121635.GF2839@codeblueprint.co.uk>
 <87h9eked24.fsf@jcompost-MOBL1.tl.intel.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <87h9eked24.fsf@jcompost-MOBL1.tl.intel.com>
User-Agent: Mutt/1.5.24+41 (02bc14ed1569) (2015-08-30)
Sender: linux-kernel-owner@vger.kernel.org
Content-Length: 3270
Lines: 102

On Fri, 29 Apr, at 03:53:39PM, Jeremy Compostella wrote:
> From ef3a2941769e59b11d1ec36117209dc4c90c7cf9 Mon Sep 17 00:00:00 2001
> From: Jeremy Compostella <jeremy.compostella@intel.com>
> Date: Fri, 29 Apr 2016 15:29:59 +0200
> Subject: [PATCH] efibc: fix excessive stack footprint warning
> 
> Use dynamic memory allocation instead of stack memory for the entry
> object.
> 
> This patch also fixes a potential buffer override.
> 
> Signed-off-by: Jeremy Compostella <jeremy.compostella@intel.com>
> ---
>  drivers/firmware/efi/efibc.c | 36 ++++++++++++++++++++++++------------
>  1 file changed, 24 insertions(+), 12 deletions(-)
> 
> diff --git a/drivers/firmware/efi/efibc.c b/drivers/firmware/efi/efibc.c
> index 2e0c7cc..dd6d1a6 100644
> --- a/drivers/firmware/efi/efibc.c
> +++ b/drivers/firmware/efi/efibc.c
> @@ -17,6 +17,7 @@
>  #include <linux/efi.h>
>  #include <linux/module.h>
>  #include <linux/reboot.h>
> +#include <linux/slab.h>
>  
>  static void efibc_str_to_str16(const char *str, efi_char16_t *str16)
>  {
> @@ -28,42 +29,53 @@ static void efibc_str_to_str16(const char *str, efi_char16_t *str16)
>  	str16[i] = '\0';
>  }
>  
> -static void efibc_set_variable(const char *name, const char *value)
> +static int efibc_set_variable(const char *name, const char *value)
>  {
>  	int ret;
>  	efi_guid_t guid = LINUX_EFI_LOADER_ENTRY_GUID;
> -	struct efivar_entry entry;
> +	struct efivar_entry *entry;
>  	size_t size = (strlen(value) + 1) * sizeof(efi_char16_t);
>  
> -	if (size > sizeof(entry.var.Data))
> +	if (size > sizeof(entry->var.Data)) {
>  		pr_err("value is too large");
> +		return -1;
> +	}

This isn't right. The usual return value for this scenario would be
either -ENOMEM or -EINVAL. Personally I'd lean towards -EINVAL.

>  
> -	efibc_str_to_str16(name, entry.var.VariableName);
> -	efibc_str_to_str16(value, (efi_char16_t *)entry.var.Data);
> -	memcpy(&entry.var.VendorGuid, &guid, sizeof(guid));
> +	entry = kmalloc(sizeof(*entry), GFP_KERNEL);
> +	if (!entry) {
> +		pr_err("failed to allocate efivar entry");
> +		return -1;
> +	}

This should be -ENOMEM.

>  
> -	ret = efivar_entry_set(&entry,
> +	efibc_str_to_str16(name, entry->var.VariableName);
> +	efibc_str_to_str16(value, (efi_char16_t *)entry->var.Data);
> +	memcpy(&entry->var.VendorGuid, &guid, sizeof(guid));
> +
> +	ret = efivar_entry_set(entry,
>  			       EFI_VARIABLE_NON_VOLATILE
>  			       | EFI_VARIABLE_BOOTSERVICE_ACCESS
>  			       | EFI_VARIABLE_RUNTIME_ACCESS,
> -			       size, entry.var.Data, NULL);
> +			       size, entry->var.Data, NULL);
>  	if (ret)
>  		pr_err("failed to set %s EFI variable: 0x%x\n",
>  		       name, ret);
> +
> +	kfree(entry);
> +	return ret;
>  }
>  
>  static int efibc_reboot_notifier_call(struct notifier_block *notifier,
>  				      unsigned long event, void *data)
>  {
>  	const char *reason = "shutdown";
> +	int ret;
>  
>  	if (event == SYS_RESTART)
>  		reason = "reboot";
>  
> -	efibc_set_variable("LoaderEntryRebootReason", reason);
> -
> -	if (!data)
> -		return NOTIFY_DONE;
> +	ret = efibc_set_variable("LoaderEntryRebootReason", reason);
> +	if (ret || !data)
> + 		return NOTIFY_DONE;
>  
>  	efibc_set_variable("LoaderEntryOneShot", (char *)data);

You need to check this return value too now.