From: T Makphaibulchoke <tmac@hp.com>
To: matt.fleming@intel.com, tglx@linutronix.de, mingo@redhat.com,
hpa@zytor.com, x86@kernel.org, linux-efi@vger.kernel.org,
linux-kernel@vger.kernel.org
Cc: T Makphaibulchoke <tmac@hp.com>
Subject: [PATCH v2] x86/platform/efi/efi_64.c: fix a possible hang in efi_ioremap when init_memory_mapping fails.
Date: Mon, 11 Feb 2013 13:01:15 -0700 [thread overview]
Message-ID: <1360612875-16952-1-git-send-email-tmac@hp.com> (raw)
An attempt to recursively invoke efi_ioremap may cause the kernel to get stuck in an infinite recursive loop.
Calling efi_ioremap with non-page aligned size will eventually, due to
its recursive implementation, call itself with size smaller than a page.
In this case, init_memory_mapping will fail, returning a NULL.
An attempt to recursively invoke efi_ioremap, without checking for a failure,
results in a recursive mapping of an invalid physical address range, 0 to size +
physaddr, causing the kernel to get stuck in an infinite recursive loop.
Here is an example of a hang in the efi_ioremap recursive loop with
efi_ioremap(0x3ff000, 0xfff) call,
[ 69.266517] init_memory_mapping: [mem 0x003ff000-0x003ffffe]
[ 69.267787] init_memory_mapping: [mem 0x00000000-0x003ffffe]
[ 69.268222] [mem 0x00000000-0x001fffff] page 2M
[ 69.268580] [mem 0x00200000-0x003fefff] page 4k
[ 69.268953] init_memory_mapping: [mem 0x003ff000-0x003ffffe]
[ 69.270216] init_memory_mapping: [mem 0x00000000-0x003ffffe]
[ 69.270651] [mem 0x00000000-0x001fffff] page 2M
[ 69.271016] [mem 0x00200000-0x003fefff] page 4k
Signed-off-by: T Makphaibulchoke <tmac@hp.com>
---
arch/x86/platform/efi/efi_64.c | 6 ++++++
1 files changed, 6 insertions(+), 0 deletions(-)
diff --git a/arch/x86/platform/efi/efi_64.c b/arch/x86/platform/efi/efi_64.c
index 2b20038..4b3e2b0 100644
--- a/arch/x86/platform/efi/efi_64.c
+++ b/arch/x86/platform/efi/efi_64.c
@@ -102,6 +102,12 @@ void __iomem *__init efi_ioremap(unsigned long phys_addr, unsigned long size,
return ioremap(phys_addr, size);
last_map_pfn = init_memory_mapping(phys_addr, phys_addr + size);
+
+ if (!last_map_pfn) {
+ /* Do not try to rmmap again in case of a failure */
+ return NULL;
+ }
+
if ((last_map_pfn << PAGE_SHIFT) < phys_addr + size) {
unsigned long top = last_map_pfn << PAGE_SHIFT;
efi_ioremap(top, size - (top - phys_addr), type, attribute);
--
1.7.1
reply other threads:[~2013-02-11 20:01 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1360612875-16952-1-git-send-email-tmac@hp.com \
--to=tmac@hp.com \
--cc=hpa@zytor.com \
--cc=linux-efi@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=matt.fleming@intel.com \
--cc=mingo@redhat.com \
--cc=tglx@linutronix.de \
--cc=x86@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox