Linux EFI development
 help / color / mirror / Atom feed
From: Gen Zhang <blackgod016574@gmail.com>
To: Ard Biesheuvel <ard.biesheuvel@linaro.org>, dvhart@infradead.org
Cc: linux-efi@vger.kernel.org, linux-kernel@vger.kernel.org
Subject: [PATCH v2] efi_64: Fix a missing-check bug in arch/x86/platform/efi/efi_64.c
Date: Thu, 23 May 2019 08:51:33 +0800	[thread overview]
Message-ID: <20190523005133.GA14881@zhanggen-UX430UQ> (raw)
In-Reply-To: <CAKv+Gu_mwFpdtNZm9QMFn69+vOMTOpv9gvuhnBL2NBXvwkhXqg@mail.gmail.com>

In efi_call_phys_prolog(), save_pgd is allocated by kmalloc_array(). 
And it is dereferenced in the following codes. However, memory 
allocation functions such as kmalloc_array() may fail. Dereferencing
this save_pgd null pointer may cause the kernel go wrong. Thus we  
should check this allocation.
Further, if efi_call_phys_prolog() returns NULL, we should abort the
process in phys_efi_set_virtual_address_map(), and return EFI_ABORTED.

Signed-off-by: Gen Zhang <blackgod016574@gmail.com>

---
diff --git a/arch/x86/platform/efi/efi.c b/arch/x86/platform/efi/efi.c
index e1cb01a..a7189a3 100644
--- a/arch/x86/platform/efi/efi.c
+++ b/arch/x86/platform/efi/efi.c
@@ -85,6 +85,8 @@ static efi_status_t __init phys_efi_set_virtual_address_map(
 	pgd_t *save_pgd;
 
 	save_pgd = efi_call_phys_prolog();
+	if (!save_pgd)
+		return EFI_ABORTED;
 
 	/* Disable interrupts around EFI calls: */
 	local_irq_save(flags);
diff --git a/arch/x86/platform/efi/efi_64.c b/arch/x86/platform/efi/efi_64.c
index cf0347f..828460a 100644
--- a/arch/x86/platform/efi/efi_64.c
+++ b/arch/x86/platform/efi/efi_64.c
@@ -91,6 +91,8 @@ pgd_t * __init efi_call_phys_prolog(void)
 
 	n_pgds = DIV_ROUND_UP((max_pfn << PAGE_SHIFT), PGDIR_SIZE);
 	save_pgd = kmalloc_array(n_pgds, sizeof(*save_pgd), GFP_KERNEL);
+	if (!save_pgd)
+		return NULL;
 
 	/*
 	 * Build 1:1 identity mapping for efi=old_map usage. Note that
---

  parent reply	other threads:[~2019-05-23  0:51 UTC|newest]

Thread overview: 8+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
     [not found] <20190517082633.GA3890@zhanggen-UX430UQ>
2019-05-17  8:41 ` [PATCH] efi_64: Fix a missing-check bug in arch/x86/platform/efi/efi_64.c of Linux 5.1 Ard Biesheuvel
     [not found]   ` <20190517090628.GA4162@zhanggen-UX430UQ>
2019-05-17  9:24     ` Ard Biesheuvel
2019-05-17  9:43       ` Gen Zhang
2019-05-23  0:51       ` Gen Zhang [this message]
2019-05-24 16:07         ` [PATCH v2] efi_64: Fix a missing-check bug in arch/x86/platform/efi/efi_64.c Ard Biesheuvel
2019-05-25  2:36           ` Gen Zhang
2019-05-25  9:18             ` Ard Biesheuvel
2019-05-25  9:40               ` Gen Zhang

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20190523005133.GA14881@zhanggen-UX430UQ \
    --to=blackgod016574@gmail.com \
    --cc=ard.biesheuvel@linaro.org \
    --cc=dvhart@infradead.org \
    --cc=linux-efi@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox