mirror of
https://github.com/edk2-porting/linux-next.git
synced 2024-12-21 11:44:01 +08:00
20b1e22d01
With the following commit:4bc9f92e64
("x86/efi-bgrt: Use efi_mem_reserve() to avoid copying image data") ... efi_bgrt_init() calls into the memblock allocator through efi_mem_reserve() => efi_arch_mem_reserve() *after* mm_init() has been called. Indeed, KASAN reports a bad read access later on in efi_free_boot_services(): BUG: KASAN: use-after-free in efi_free_boot_services+0xae/0x24c at addr ffff88022de12740 Read of size 4 by task swapper/0/0 page:ffffea0008b78480 count:0 mapcount:-127 mapping: (null) index:0x1 flags: 0x5fff8000000000() [...] Call Trace: dump_stack+0x68/0x9f kasan_report_error+0x4c8/0x500 kasan_report+0x58/0x60 __asan_load4+0x61/0x80 efi_free_boot_services+0xae/0x24c start_kernel+0x527/0x562 x86_64_start_reservations+0x24/0x26 x86_64_start_kernel+0x157/0x17a start_cpu+0x5/0x14 The instruction at the given address is the first read from the memmap's memory, i.e. the read of md->type in efi_free_boot_services(). Note that the writes earlier in efi_arch_mem_reserve() don't splat because they're done through early_memremap()ed addresses. So, after memblock is gone, allocations should be done through the "normal" page allocator. Introduce a helper, efi_memmap_alloc() for this. Use it from efi_arch_mem_reserve(), efi_free_boot_services() and, for the sake of consistency, from efi_fake_memmap() as well. Note that for the latter, the memmap allocations cease to be page aligned. This isn't needed though. Tested-by: Dan Williams <dan.j.williams@intel.com> Signed-off-by: Nicolai Stange <nicstange@gmail.com> Reviewed-by: Ard Biesheuvel <ard.biesheuvel@linaro.org> Cc: <stable@vger.kernel.org> # v4.9 Cc: Dave Young <dyoung@redhat.com> Cc: Linus Torvalds <torvalds@linux-foundation.org> Cc: Matt Fleming <matt@codeblueprint.co.uk> Cc: Mika Penttilä <mika.penttila@nextfour.com> Cc: Peter Zijlstra <peterz@infradead.org> Cc: Thomas Gleixner <tglx@linutronix.de> Cc: linux-efi@vger.kernel.org Fixes:4bc9f92e64
("x86/efi-bgrt: Use efi_mem_reserve() to avoid copying image data") Link: http://lkml.kernel.org/r/20170105125130.2815-1-nicstange@gmail.com Signed-off-by: Ingo Molnar <mingo@kernel.org>
342 lines
8.8 KiB
C
342 lines
8.8 KiB
C
/*
|
|
* Common EFI memory map functions.
|
|
*/
|
|
|
|
#define pr_fmt(fmt) "efi: " fmt
|
|
|
|
#include <linux/init.h>
|
|
#include <linux/kernel.h>
|
|
#include <linux/efi.h>
|
|
#include <linux/io.h>
|
|
#include <asm/early_ioremap.h>
|
|
#include <linux/memblock.h>
|
|
#include <linux/slab.h>
|
|
|
|
static phys_addr_t __init __efi_memmap_alloc_early(unsigned long size)
|
|
{
|
|
return memblock_alloc(size, 0);
|
|
}
|
|
|
|
static phys_addr_t __init __efi_memmap_alloc_late(unsigned long size)
|
|
{
|
|
unsigned int order = get_order(size);
|
|
struct page *p = alloc_pages(GFP_KERNEL, order);
|
|
|
|
if (!p)
|
|
return 0;
|
|
|
|
return PFN_PHYS(page_to_pfn(p));
|
|
}
|
|
|
|
/**
|
|
* efi_memmap_alloc - Allocate memory for the EFI memory map
|
|
* @num_entries: Number of entries in the allocated map.
|
|
*
|
|
* Depending on whether mm_init() has already been invoked or not,
|
|
* either memblock or "normal" page allocation is used.
|
|
*
|
|
* Returns the physical address of the allocated memory map on
|
|
* success, zero on failure.
|
|
*/
|
|
phys_addr_t __init efi_memmap_alloc(unsigned int num_entries)
|
|
{
|
|
unsigned long size = num_entries * efi.memmap.desc_size;
|
|
|
|
if (slab_is_available())
|
|
return __efi_memmap_alloc_late(size);
|
|
|
|
return __efi_memmap_alloc_early(size);
|
|
}
|
|
|
|
/**
|
|
* __efi_memmap_init - Common code for mapping the EFI memory map
|
|
* @data: EFI memory map data
|
|
* @late: Use early or late mapping function?
|
|
*
|
|
* This function takes care of figuring out which function to use to
|
|
* map the EFI memory map in efi.memmap based on how far into the boot
|
|
* we are.
|
|
*
|
|
* During bootup @late should be %false since we only have access to
|
|
* the early_memremap*() functions as the vmalloc space isn't setup.
|
|
* Once the kernel is fully booted we can fallback to the more robust
|
|
* memremap*() API.
|
|
*
|
|
* Returns zero on success, a negative error code on failure.
|
|
*/
|
|
static int __init
|
|
__efi_memmap_init(struct efi_memory_map_data *data, bool late)
|
|
{
|
|
struct efi_memory_map map;
|
|
phys_addr_t phys_map;
|
|
|
|
if (efi_enabled(EFI_PARAVIRT))
|
|
return 0;
|
|
|
|
phys_map = data->phys_map;
|
|
|
|
if (late)
|
|
map.map = memremap(phys_map, data->size, MEMREMAP_WB);
|
|
else
|
|
map.map = early_memremap(phys_map, data->size);
|
|
|
|
if (!map.map) {
|
|
pr_err("Could not map the memory map!\n");
|
|
return -ENOMEM;
|
|
}
|
|
|
|
map.phys_map = data->phys_map;
|
|
map.nr_map = data->size / data->desc_size;
|
|
map.map_end = map.map + data->size;
|
|
|
|
map.desc_version = data->desc_version;
|
|
map.desc_size = data->desc_size;
|
|
map.late = late;
|
|
|
|
set_bit(EFI_MEMMAP, &efi.flags);
|
|
|
|
efi.memmap = map;
|
|
|
|
return 0;
|
|
}
|
|
|
|
/**
|
|
* efi_memmap_init_early - Map the EFI memory map data structure
|
|
* @data: EFI memory map data
|
|
*
|
|
* Use early_memremap() to map the passed in EFI memory map and assign
|
|
* it to efi.memmap.
|
|
*/
|
|
int __init efi_memmap_init_early(struct efi_memory_map_data *data)
|
|
{
|
|
/* Cannot go backwards */
|
|
WARN_ON(efi.memmap.late);
|
|
|
|
return __efi_memmap_init(data, false);
|
|
}
|
|
|
|
void __init efi_memmap_unmap(void)
|
|
{
|
|
if (!efi.memmap.late) {
|
|
unsigned long size;
|
|
|
|
size = efi.memmap.desc_size * efi.memmap.nr_map;
|
|
early_memunmap(efi.memmap.map, size);
|
|
} else {
|
|
memunmap(efi.memmap.map);
|
|
}
|
|
|
|
efi.memmap.map = NULL;
|
|
clear_bit(EFI_MEMMAP, &efi.flags);
|
|
}
|
|
|
|
/**
|
|
* efi_memmap_init_late - Map efi.memmap with memremap()
|
|
* @phys_addr: Physical address of the new EFI memory map
|
|
* @size: Size in bytes of the new EFI memory map
|
|
*
|
|
* Setup a mapping of the EFI memory map using ioremap_cache(). This
|
|
* function should only be called once the vmalloc space has been
|
|
* setup and is therefore not suitable for calling during early EFI
|
|
* initialise, e.g. in efi_init(). Additionally, it expects
|
|
* efi_memmap_init_early() to have already been called.
|
|
*
|
|
* The reason there are two EFI memmap initialisation
|
|
* (efi_memmap_init_early() and this late version) is because the
|
|
* early EFI memmap should be explicitly unmapped once EFI
|
|
* initialisation is complete as the fixmap space used to map the EFI
|
|
* memmap (via early_memremap()) is a scarce resource.
|
|
*
|
|
* This late mapping is intended to persist for the duration of
|
|
* runtime so that things like efi_mem_desc_lookup() and
|
|
* efi_mem_attributes() always work.
|
|
*
|
|
* Returns zero on success, a negative error code on failure.
|
|
*/
|
|
int __init efi_memmap_init_late(phys_addr_t addr, unsigned long size)
|
|
{
|
|
struct efi_memory_map_data data = {
|
|
.phys_map = addr,
|
|
.size = size,
|
|
};
|
|
|
|
/* Did we forget to unmap the early EFI memmap? */
|
|
WARN_ON(efi.memmap.map);
|
|
|
|
/* Were we already called? */
|
|
WARN_ON(efi.memmap.late);
|
|
|
|
/*
|
|
* It makes no sense to allow callers to register different
|
|
* values for the following fields. Copy them out of the
|
|
* existing early EFI memmap.
|
|
*/
|
|
data.desc_version = efi.memmap.desc_version;
|
|
data.desc_size = efi.memmap.desc_size;
|
|
|
|
return __efi_memmap_init(&data, true);
|
|
}
|
|
|
|
/**
|
|
* efi_memmap_install - Install a new EFI memory map in efi.memmap
|
|
* @addr: Physical address of the memory map
|
|
* @nr_map: Number of entries in the memory map
|
|
*
|
|
* Unlike efi_memmap_init_*(), this function does not allow the caller
|
|
* to switch from early to late mappings. It simply uses the existing
|
|
* mapping function and installs the new memmap.
|
|
*
|
|
* Returns zero on success, a negative error code on failure.
|
|
*/
|
|
int __init efi_memmap_install(phys_addr_t addr, unsigned int nr_map)
|
|
{
|
|
struct efi_memory_map_data data;
|
|
|
|
efi_memmap_unmap();
|
|
|
|
data.phys_map = addr;
|
|
data.size = efi.memmap.desc_size * nr_map;
|
|
data.desc_version = efi.memmap.desc_version;
|
|
data.desc_size = efi.memmap.desc_size;
|
|
|
|
return __efi_memmap_init(&data, efi.memmap.late);
|
|
}
|
|
|
|
/**
|
|
* efi_memmap_split_count - Count number of additional EFI memmap entries
|
|
* @md: EFI memory descriptor to split
|
|
* @range: Address range (start, end) to split around
|
|
*
|
|
* Returns the number of additional EFI memmap entries required to
|
|
* accomodate @range.
|
|
*/
|
|
int __init efi_memmap_split_count(efi_memory_desc_t *md, struct range *range)
|
|
{
|
|
u64 m_start, m_end;
|
|
u64 start, end;
|
|
int count = 0;
|
|
|
|
start = md->phys_addr;
|
|
end = start + (md->num_pages << EFI_PAGE_SHIFT) - 1;
|
|
|
|
/* modifying range */
|
|
m_start = range->start;
|
|
m_end = range->end;
|
|
|
|
if (m_start <= start) {
|
|
/* split into 2 parts */
|
|
if (start < m_end && m_end < end)
|
|
count++;
|
|
}
|
|
|
|
if (start < m_start && m_start < end) {
|
|
/* split into 3 parts */
|
|
if (m_end < end)
|
|
count += 2;
|
|
/* split into 2 parts */
|
|
if (end <= m_end)
|
|
count++;
|
|
}
|
|
|
|
return count;
|
|
}
|
|
|
|
/**
|
|
* efi_memmap_insert - Insert a memory region in an EFI memmap
|
|
* @old_memmap: The existing EFI memory map structure
|
|
* @buf: Address of buffer to store new map
|
|
* @mem: Memory map entry to insert
|
|
*
|
|
* It is suggested that you call efi_memmap_split_count() first
|
|
* to see how large @buf needs to be.
|
|
*/
|
|
void __init efi_memmap_insert(struct efi_memory_map *old_memmap, void *buf,
|
|
struct efi_mem_range *mem)
|
|
{
|
|
u64 m_start, m_end, m_attr;
|
|
efi_memory_desc_t *md;
|
|
u64 start, end;
|
|
void *old, *new;
|
|
|
|
/* modifying range */
|
|
m_start = mem->range.start;
|
|
m_end = mem->range.end;
|
|
m_attr = mem->attribute;
|
|
|
|
/*
|
|
* The EFI memory map deals with regions in EFI_PAGE_SIZE
|
|
* units. Ensure that the region described by 'mem' is aligned
|
|
* correctly.
|
|
*/
|
|
if (!IS_ALIGNED(m_start, EFI_PAGE_SIZE) ||
|
|
!IS_ALIGNED(m_end + 1, EFI_PAGE_SIZE)) {
|
|
WARN_ON(1);
|
|
return;
|
|
}
|
|
|
|
for (old = old_memmap->map, new = buf;
|
|
old < old_memmap->map_end;
|
|
old += old_memmap->desc_size, new += old_memmap->desc_size) {
|
|
|
|
/* copy original EFI memory descriptor */
|
|
memcpy(new, old, old_memmap->desc_size);
|
|
md = new;
|
|
start = md->phys_addr;
|
|
end = md->phys_addr + (md->num_pages << EFI_PAGE_SHIFT) - 1;
|
|
|
|
if (m_start <= start && end <= m_end)
|
|
md->attribute |= m_attr;
|
|
|
|
if (m_start <= start &&
|
|
(start < m_end && m_end < end)) {
|
|
/* first part */
|
|
md->attribute |= m_attr;
|
|
md->num_pages = (m_end - md->phys_addr + 1) >>
|
|
EFI_PAGE_SHIFT;
|
|
/* latter part */
|
|
new += old_memmap->desc_size;
|
|
memcpy(new, old, old_memmap->desc_size);
|
|
md = new;
|
|
md->phys_addr = m_end + 1;
|
|
md->num_pages = (end - md->phys_addr + 1) >>
|
|
EFI_PAGE_SHIFT;
|
|
}
|
|
|
|
if ((start < m_start && m_start < end) && m_end < end) {
|
|
/* first part */
|
|
md->num_pages = (m_start - md->phys_addr) >>
|
|
EFI_PAGE_SHIFT;
|
|
/* middle part */
|
|
new += old_memmap->desc_size;
|
|
memcpy(new, old, old_memmap->desc_size);
|
|
md = new;
|
|
md->attribute |= m_attr;
|
|
md->phys_addr = m_start;
|
|
md->num_pages = (m_end - m_start + 1) >>
|
|
EFI_PAGE_SHIFT;
|
|
/* last part */
|
|
new += old_memmap->desc_size;
|
|
memcpy(new, old, old_memmap->desc_size);
|
|
md = new;
|
|
md->phys_addr = m_end + 1;
|
|
md->num_pages = (end - m_end) >>
|
|
EFI_PAGE_SHIFT;
|
|
}
|
|
|
|
if ((start < m_start && m_start < end) &&
|
|
(end <= m_end)) {
|
|
/* first part */
|
|
md->num_pages = (m_start - md->phys_addr) >>
|
|
EFI_PAGE_SHIFT;
|
|
/* latter part */
|
|
new += old_memmap->desc_size;
|
|
memcpy(new, old, old_memmap->desc_size);
|
|
md = new;
|
|
md->phys_addr = m_start;
|
|
md->num_pages = (end - md->phys_addr + 1) >>
|
|
EFI_PAGE_SHIFT;
|
|
md->attribute |= m_attr;
|
|
}
|
|
}
|
|
}
|