From: "Kiryl Shutsemau (Meta)" <kas@kernel.org>
To: Ard Biesheuvel <ardb@kernel.org>,
Thomas Gleixner <tglx@kernel.org>, Ingo Molnar <mingo@redhat.com>,
Borislav Petkov <bp@alien8.de>,
Dave Hansen <dave.hansen@linux.intel.com>,
Tom Lendacky <thomas.lendacky@amd.com>
Cc: x86@kernel.org, linux-efi@vger.kernel.org, linux-mm@kvack.org,
linux-kernel@vger.kernel.org, Moritz Sanft <ms@edgeless.systems>,
Mike Rapoport <rppt@kernel.org>,
"Kiryl Shutsemau (Meta)" <kas@kernel.org>
Subject: [PATCHv2 2/2] efi: Align unaccepted memory range to page boundary
Date: Tue, 17 Feb 2026 10:49:57 +0000 [thread overview]
Message-ID: <20260217104957.249340-3-kas@kernel.org> (raw)
In-Reply-To: <20260217104957.249340-1-kas@kernel.org>
The accept_memory() and range_contains_unaccepted_memory() functions
employ a "guard page" logic to prevent crashes with load_unaligned_zeropad().
This logic extends the range to be accepted (or checked) by one unit_size
if the end of the range is aligned to a unit_size boundary.
However, if the caller passes a range that is not page-aligned, the
'end' of the range might not be numerically aligned to unit_size, even
if it covers the last page of a unit. This causes the "if (!(end % unit_size))"
check to fail, skipping the necessary extension and leaving the next
unit unaccepted, which can lead to a kernel panic when accessed by
load_unaligned_zeropad().
Align the start address down and the size up to the nearest page
boundary before performing the unit_size alignment check. This ensures
that the guard unit is correctly added when the range effectively ends
on a unit boundary.
Signed-off-by: Kiryl Shutsemau (Meta) <kas@kernel.org>
---
drivers/firmware/efi/unaccepted_memory.c | 10 ++++++++--
1 file changed, 8 insertions(+), 2 deletions(-)
diff --git a/drivers/firmware/efi/unaccepted_memory.c b/drivers/firmware/efi/unaccepted_memory.c
index c2c067eff634..4a8ec8d6a571 100644
--- a/drivers/firmware/efi/unaccepted_memory.c
+++ b/drivers/firmware/efi/unaccepted_memory.c
@@ -35,14 +35,17 @@ void accept_memory(phys_addr_t start, unsigned long size)
struct efi_unaccepted_memory *unaccepted;
unsigned long range_start, range_end;
struct accept_range range, *entry;
- phys_addr_t end = start + size;
unsigned long flags;
+ phys_addr_t end;
u64 unit_size;
unaccepted = efi_get_unaccepted_table();
if (!unaccepted)
return;
+ end = PAGE_ALIGN(start + size);
+ start = PAGE_ALIGN_DOWN(start);
+
unit_size = unaccepted->unit_size;
/*
@@ -160,15 +163,18 @@ void accept_memory(phys_addr_t start, unsigned long size)
bool range_contains_unaccepted_memory(phys_addr_t start, unsigned long size)
{
struct efi_unaccepted_memory *unaccepted;
- phys_addr_t end = start + size;
unsigned long flags;
bool ret = false;
+ phys_addr_t end;
u64 unit_size;
unaccepted = efi_get_unaccepted_table();
if (!unaccepted)
return false;
+ end = PAGE_ALIGN(start + size);
+ start = PAGE_ALIGN_DOWN(start);
+
unit_size = unaccepted->unit_size;
/*
--
2.51.2
next prev parent reply other threads:[~2026-02-17 10:50 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-02-17 10:49 [PATCHv2 0/2] efi: Fix alignenment issues in unaccepted memory code Kiryl Shutsemau (Meta)
2026-02-17 10:49 ` [PATCHv2 1/2] efi: Fix reservation of unaccepted memory table Kiryl Shutsemau (Meta)
2026-02-17 10:49 ` Kiryl Shutsemau (Meta) [this message]
2026-02-17 10:58 ` [PATCHv2 0/2] efi: Fix alignenment issues in unaccepted memory code Ard Biesheuvel
2026-02-17 12:09 ` Mike Rapoport
2026-02-17 13:56 ` Tom Lendacky
2026-02-19 9:26 ` Ard Biesheuvel
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260217104957.249340-3-kas@kernel.org \
--to=kas@kernel.org \
--cc=ardb@kernel.org \
--cc=bp@alien8.de \
--cc=dave.hansen@linux.intel.com \
--cc=linux-efi@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mm@kvack.org \
--cc=mingo@redhat.com \
--cc=ms@edgeless.systems \
--cc=rppt@kernel.org \
--cc=tglx@kernel.org \
--cc=thomas.lendacky@amd.com \
--cc=x86@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.