iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
4d69c80e0d
linux/drivers/firmware/efi
History
Qian Cai 74c953ca5f efi/arm64: Fix debugfs crash by adding a terminator for ptdump marker 
When reading 'efi_page_tables' debugfs triggers an out-of-bounds access here:

  arch/arm64/mm/dump.c: 282
  if (addr >= st->marker[1].start_address) {

called from:

  arch/arm64/mm/dump.c: 331
  note_page(st, addr, 2, pud_val(pud));

because st->marker++ is is called after "UEFI runtime end" which is the
last element in addr_marker[]. Therefore, add a terminator like the one
for kernel_page_tables, so it can be skipped to print out non-existent
markers.

Here's the KASAN bug report:

  # cat /sys/kernel/debug/efi_page_tables
  ---[ UEFI runtime start ]---
  0x0000000020000000-0x0000000020010000          64K PTE       RW NX SHD AF ...
  0x0000000020200000-0x0000000021340000       17664K PTE       RW NX SHD AF ...
  ...
  0x0000000021920000-0x0000000021950000         192K PTE       RW x  SHD AF ...
  0x0000000021950000-0x00000000219a0000         320K PTE       RW NX SHD AF ...
  ---[ UEFI runtime end ]---
  ---[ (null) ]---
  ---[ (null) ]---

   BUG: KASAN: global-out-of-bounds in note_page+0x1f0/0xac0
   Read of size 8 at addr ffff2000123f2ac0 by task read_all/42464
   Call trace:
    dump_backtrace+0x0/0x298
    show_stack+0x24/0x30
    dump_stack+0xb0/0xdc
    print_address_description+0x64/0x2b0
    kasan_report+0x150/0x1a4
    __asan_report_load8_noabort+0x30/0x3c
    note_page+0x1f0/0xac0
    walk_pgd+0xb4/0x244
    ptdump_walk_pgd+0xec/0x140
    ptdump_show+0x40/0x50
    seq_read+0x3f8/0xad0
    full_proxy_read+0x9c/0xc0
    __vfs_read+0xfc/0x4c8
    vfs_read+0xec/0x208
    ksys_read+0xd0/0x15c
    __arm64_sys_read+0x84/0x94
    el0_svc_handler+0x258/0x304
    el0_svc+0x8/0xc

  The buggy address belongs to the variable:
   __compound_literal.0+0x20/0x800

  Memory state around the buggy address:
   ffff2000123f2980: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
   ffff2000123f2a00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fa
  >ffff2000123f2a80: fa fa fa fa 00 00 00 00 fa fa fa fa 00 00 00 00
                                            ^
   ffff2000123f2b00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
   ffff2000123f2b80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0

[ ardb: fix up whitespace ]
[ mingo: fix up some moar ]

Signed-off-by: Qian Cai <cai@lca.pw>
Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: linux-efi@vger.kernel.org
Fixes: 9d80448ac9 ("efi/arm64: Add debugfs node to dump UEFI runtime page tables")
Link: http://lkml.kernel.org/r/20190202095017.13799-2-ard.biesheuvel@linaro.org
Signed-off-by: Ingo Molnar <mingo@kernel.org>
2019-02-02 11:27:29 +01:00
..
libstub Merge branch 'efi-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip 2018-12-26 13:38:38 -08:00
test Remove 'type' argument from access_ok() function 2019-01-03 18:57:57 -08:00
apple-properties.c mm: remove include/linux/bootmem.h 2018-10-31 08:54:16 -07:00
arm-init.c efi/arm: Revert deferred unmap of early memmap mapping 2018-11-15 10:04:46 +01:00
arm-runtime.c efi/arm64: Fix debugfs crash by adding a terminator for ptdump marker 2019-02-02 11:27:29 +01:00
capsule-loader.c efi/capsule-loader: Don't output reset log when reset flags are not set 2018-05-14 08:57:49 +02:00
capsule.c treewide: kzalloc() -> kcalloc() 2018-06-12 16:19:22 -07:00
cper-arm.c efi/cper: Remove the INDENT_SP silliness 2018-05-14 08:57:47 +02:00
cper-x86.c efi: Decode IA32/X64 Context Info structure 2018-05-14 08:57:48 +02:00
cper.c efi/cper: Use consistent types for UUIDs 2018-07-22 14:13:43 +02:00
dev-path-parser.c
efi-bgrt.c efi/bgrt: Drop __initdata from bgrt_image_size 2018-07-03 17:43:10 +02:00
efi-pstore.c pstore: Convert buf_lock to semaphore 2018-12-03 17:11:02 -08:00
efi.c efi: Reduce the amount of memblock reservations for persistent allocations 2018-11-30 09:37:57 +01:00
efibc.c
efivars.c compat: Cleanup in_compat_syscall() callers 2018-11-01 13:02:21 +01:00
esrt.c efi/esrt: Only call efi_mem_reserve() for boot services memory 2018-07-17 09:15:05 +02:00
fake_mem.c
Kconfig efi/libstub/arm: default EFI_ARMSTUB_DTB_LOADER to y 2018-09-12 16:41:41 +02:00
Makefile efi: Decode IA32/X64 Processor Error Section 2018-05-14 08:57:47 +02:00
memattr.c
memmap.c efi/arm: Revert deferred unmap of early memmap mapping 2018-11-15 10:04:46 +01:00
reboot.c
runtime-map.c treewide: kzalloc() -> kcalloc() 2018-06-12 16:19:22 -07:00
runtime-wrappers.c efi: Fix debugobjects warning on 'efi_rts_work' 2018-11-15 10:04:45 +01:00
tpm.c efi: call get_event_log before ExitBootServices 2018-01-08 12:58:35 +02:00
vars.c firmware/efi: Add NULL pointer checks in efivars API functions 2018-11-30 09:06:32 +01:00