Re: General protection fault in efivarfs

[Lingzhu Xiang <lxiang-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org>]

On 12/24/2012 07:00 PM, joeyli wrote:
> 於 五，2012-12-21 於 19:05 +0800，Lingzhu Xiang 提到：
>> The following reproducer triggers certain bugs in efivarfs_file_write.
>>
>> #!/bin/bash
>> p=/sys/firmware/efi/efivars
>> mount -t efivarfs - $p
>> cat $p/Lang-*>$p/test-12341234-1234-1234-1234-123412341234
>> umount $p
>> mount -t efivarfs - $p
>> echo -en "\0\0\0\0">$p/test-12341234-1234-1234-1234-123412341234
> 
> The problem is check EFI_VARIABLE_MASK in efivars.c that is not enough
> for deny use 0x00000000 attributes.
> 
> Per UEFI spec, runtime variable at least need has attributes
> EFI_VARIABLE_BOOTSERVICE_ACCESS and EFI_VARIABLE_RUNTIME_ACCESS.
> Otherwise UEFI BIOS will occur unexpected error.
> 
> Please try the following patch.

Thank you for your patch.

Per UEFI spec, echo -en "\0\0\0\0" should be equivalent to deleting.
This is what efivarfs_unlink is doing but I wanted to avoid its
underflowing when reproducing this.

This still reproduces the bug and passes the check in your patch:

echo -en "\x07\0\0\0" >$p/test-12341234-1234-1234-1234-123412341234

> diff --git a/drivers/firmware/efivars.c b/drivers/firmware/efivars.c
> index 7b1c374..7aeb4a5 100644
> --- a/drivers/firmware/efivars.c
> +++ b/drivers/firmware/efivars.c
> @@ -706,6 +706,10 @@ static ssize_t efivarfs_file_write(struct file *file,
>   	if (attributes&  ~(EFI_VARIABLE_MASK))
>   		return -EINVAL;
> 
> +	if (!((attributes&  EFI_VARIABLE_BOOTSERVICE_ACCESS)&&
> +		(attributes&  EFI_VARIABLE_RUNTIME_ACCESS)))
> +		return -EINVAL;
> +
>   	efivars = var->efivars;

--
Lingzhu Xiang