[PATCH] arm64/mm: Route faults taken by EFI runtime firmware to no_context

[PATCH] arm64/mm: Route faults taken by EFI runtime firmware to no_context

[Ard Biesheuvel]

From: Ard Biesheuvel <ardb@kernel.org>

When EFI runtime services are invoked from a preemptible kthread, the
kthread runs with efi_mm installed via kthread_use_mm() and preemption
enabled, so neither faulthandler_disabled() nor !mm applies in
do_page_fault(). A permission fault taken by the firmware on one of its
own (TTBR0) mappings then hits the 'access to user memory outside
uaccess routines' check and oopses, without efi_runtime_fixup_exception()
ever being consulted.

efi_mm has no VMAs, so there is nothing for the mm to resolve. Send such
faults to no_context directly, so that __do_kernel_fault() can recover
from them as it does when the call is made with preemption disabled.

Fixes: a5baf582f4c0 ("arm64/efi: Call EFI runtime services without disabling preemption")
Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
---
 arch/arm64/mm/fault.c | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/arch/arm64/mm/fault.c b/arch/arm64/mm/fault.c
index 0b52557652be..db308fe01c4f 100644
--- a/arch/arm64/mm/fault.c
+++ b/arch/arm64/mm/fault.c
@@ -40,6 +40,7 @@
 #include <asm/kprobes.h>
 #include <asm/mte.h>
 #include <asm/processor.h>
+#include <asm/stacktrace.h>
 #include <asm/sysreg.h>
 #include <asm/system_misc.h>
 #include <asm/tlbflush.h>
@@ -621,6 +622,17 @@ static int __kprobes do_page_fault(unsigned long far, unsigned long esr,
 	if (faulthandler_disabled() || !mm)
 		goto no_context;
 
+	/*
+	 * Faults taken by EFI runtime services firmware are never resolved by
+	 * the mm (efi_mm has no VMAs), and must reach __do_kernel_fault() so
+	 * that efi_runtime_fixup_exception() can recover from them. When EFI
+	 * runtime services are invoked from a preemptible kthread, neither of
+	 * the conditions above applies, so check for this explicitly.
+	 */
+	if (IS_ENABLED(CONFIG_EFI) && !user_mode(regs) &&
+	    is_ttbr0_addr(regs->pc) && current_in_efi())
+		goto no_context;
+
 	if (user_mode(regs))
 		mm_flags |= FAULT_FLAG_USER;
 
-- 
2.56.0.385.gd3acb90ef8-goog