From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=100.103.45.18 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1793214108; b=DIwzZ0FyrJ/UJUmvpARfFwBUIETtnpxwiogLAJ9WwrP+YeNaOqk0sB5rHRPmvqnwtBCC vppWRDm6jx8fZuQpKsS6f8GU1T2P4sS000dIkXPt95SxeaX0VTL4jR7G9ScTPg08R+kDV GDrbCxWKhEFuEEHP5SPxErhjxg0I0fWv9b+iA2qyBR/OEpbZs0ab9B7RGdzbCxQHSreq/ rPkZ9DJayC1H16iJbTUWR7tc5fnx104bjmtIDC5vn/gSdTlcHDYLwTtTFw4O6aC+5RqIr 0QGngDR+vacHyHjYXAtqpTJvXz/XzlsRzRHPTpfXPJXpz7i20y+efsdwARfnsLcGWGQ== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1793214108; h=Received:DKIM-Signature:From:To:Cc:Subject:Date:Message-ID:X-Mailer: In-Reply-To:References:User-Agent:X-stable:X-Patchwork-Hint: MIME-Version:Content-Transfer-Encoding; bh=fH9OdVqUFe3KXZIxBNsu47v4NdgRfZ2zZOIpQklkn2Y=; b=nllqlMVmkUXJY+ZlazjMNoESn1ftcoxbE3qnoiZBbUOZUhfcb7CQ/jpL2x0tpoBJdQlr lwNXsFpf4sbks2DFwoAbdItV/VB5cJio6qT0Id2tpqL1/yTkZMg3bXv2qxgm+h6C/njlB rwcJzFaszCQ2OopYOTS8JVDg3f02ToagoaD5mH1hkxckLs5fYAfJ8HqqmiiGJxXYcJBD9 Yyi9fS0jTU6qg20sAx6pSMKI7s+iGFzgfZ0NT2GjnBi9bhpx2jYdqJc2mCgEh4xa4hOgb QxLF72KiB9w4ML/N3JroSqsZUoTg6xpLDISpZk+jBn0Bx89Jz3ZAF63p8mW9Zl8G2ew== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=QoTLw5Ai; arc=none smtp.remote-ip=100.103.45.18 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B627E606A31D; Wed, 28 Oct 2026 19:01:47 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key, unprotected) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=QoTLw5Ai Received: by smtp.kernel.org (Postfix) with ESMTPSA id 11C151F01825; Wed, 28 Oct 2026 19:01:46 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1793214107; bh=fH9OdVqUFe3KXZIxBNsu47v4NdgRfZ2zZOIpQklkn2Y=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=QoTLw5AizFKhDRS3ILPK3cie+ixS5i/yXQi3opWlJktyF8DoZ9sEB4znndDD5aJhr Ur/YQ/DSxxjT7XB+otai6+uAg9urXvhQRKQLzOS7HUfgPalHdxb6Rzz2aeM4gQNZHb CPuB7cNxKsNxZcu6JzZnTfv4c7UPeZLi45zPgKe4= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Peter Jones , Ard Biesheuvel , Sasha Levin Subject: [PATCH 6.1 0742/1887] efi: Dont map the entire mokvar table to determine its size Date: Wed, 28 Oct 2026 17:47:18 +0100 Message-ID: <20261028170516.333007466@linuxfoundation.org> X-Mailer: git-send-email 2.56.0 In-Reply-To: <20261028170459.200466217@linuxfoundation.org> References: <20261028170459.200466217@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore X-Mailing-List: patches@lists.linux.dev List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.1-stable review patch. If anyone has any objections, please let me know. ------------------ From: Peter Jones [ Upstream commit 2b90e7ace79774a3540ce569e000388f8d22c9e0 ] Currently, when validating the mokvar table, we (re)map the entire table on each iteration of the loop, adding space as we discover new entries. If the table grows over a certain size, this fails due to limitations of early_memmap(), and we get a failure and traceback: ------------[ cut here ]------------ WARNING: CPU: 0 PID: 0 at mm/early_ioremap.c:139 __early_ioremap+0xef/0x220 ... Call Trace: ? __early_ioremap+0xef/0x220 ? __warn.cold+0x93/0xfa ? __early_ioremap+0xef/0x220 ? report_bug+0xff/0x140 ? early_fixup_exception+0x5d/0xb0 ? early_idt_handler_common+0x2f/0x3a ? __early_ioremap+0xef/0x220 ? efi_mokvar_table_init+0xce/0x1d0 ? setup_arch+0x864/0xc10 ? start_kernel+0x6b/0xa10 ? x86_64_start_reservations+0x24/0x30 ? x86_64_start_kernel+0xed/0xf0 ? common_startup_64+0x13e/0x141 ---[ end trace 0000000000000000 ]--- mokvar: Failed to map EFI MOKvar config table pa=0x7c4c3000, size=265187. Mapping the entire structure isn't actually necessary, as we don't ever need more than one entry header mapped at once. Changes efi_mokvar_table_init() to only map each entry header, not the entire table, when determining the table size. Since we're not mapping any data past the variable name, it also changes the code to enforce that each variable name is NUL terminated, rather than attempting to verify it in place. Cc: Signed-off-by: Peter Jones Signed-off-by: Ard Biesheuvel Signed-off-by: Sasha Levin --- drivers/firmware/efi/mokvar-table.c | 42 +++++++++-------------------- 1 file changed, 13 insertions(+), 29 deletions(-) diff --git a/drivers/firmware/efi/mokvar-table.c b/drivers/firmware/efi/mokvar-table.c index 37e1fe7a2f2b3..bd84a22805b56 100644 --- a/drivers/firmware/efi/mokvar-table.c +++ b/drivers/firmware/efi/mokvar-table.c @@ -103,9 +103,7 @@ void __init efi_mokvar_table_init(void) void *va = NULL; unsigned long cur_offset = 0; unsigned long offset_limit; - unsigned long map_size = 0; unsigned long map_size_needed = 0; - unsigned long size; struct efi_mokvar_table_entry *mokvar_entry; int err; @@ -134,48 +132,34 @@ void __init efi_mokvar_table_init(void) */ err = -EINVAL; while (cur_offset + sizeof(*mokvar_entry) <= offset_limit) { - mokvar_entry = va + cur_offset; - map_size_needed = cur_offset + sizeof(*mokvar_entry); - if (map_size_needed > map_size) { - if (va) - early_memunmap(va, map_size); - /* - * Map a little more than the fixed size entry - * header, anticipating some data. It's safe to - * do so as long as we stay within current memory - * descriptor. - */ - map_size = min(map_size_needed + 2*EFI_PAGE_SIZE, - offset_limit); - va = early_memremap(efi.mokvar_table, map_size); - if (!va) { - pr_err("Failed to map EFI MOKvar config table pa=0x%lx, size=%lu.\n", - efi.mokvar_table, map_size); - return; - } - mokvar_entry = va + cur_offset; + if (va) + early_memunmap(va, sizeof(*mokvar_entry)); + va = early_memremap(efi.mokvar_table + cur_offset, sizeof(*mokvar_entry)); + if (!va) { + pr_err("Failed to map EFI MOKvar config table pa=0x%lx, size=%zu.\n", + efi.mokvar_table + cur_offset, sizeof(*mokvar_entry)); + return; } + mokvar_entry = va; /* Check for last sentinel entry */ if (mokvar_entry->name[0] == '\0') { if (mokvar_entry->data_size != 0) break; err = 0; + map_size_needed = cur_offset + sizeof(*mokvar_entry); break; } - /* Sanity check that the name is null terminated */ - size = strnlen(mokvar_entry->name, - sizeof(mokvar_entry->name)); - if (size >= sizeof(mokvar_entry->name)) - break; + /* Enforce that the name is NUL terminated */ + mokvar_entry->name[sizeof(mokvar_entry->name) - 1] = '\0'; /* Advance to the next entry */ - cur_offset = map_size_needed + mokvar_entry->data_size; + cur_offset += sizeof(*mokvar_entry) + mokvar_entry->data_size; } if (va) - early_memunmap(va, map_size); + early_memunmap(va, sizeof(*mokvar_entry)); if (err) { pr_err("EFI MOKvar config table is not valid\n"); return; -- 2.53.0