public inbox for linux-kernel@vger.kernel.org
 help / color / mirror / Atom feed
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: "Greg Kroah-Hartman" <gregkh@linuxfoundation.org>,
	stable@vger.kernel.org,
	"Amadeusz Sławiński" <amadeuszx.slawinski@linux.intel.com>,
	"Ard Biesheuvel" <ardb@kernel.org>
Subject: [PATCH 6.0 16/20] efi: ssdt: Dont free memory if ACPI table was loaded successfully
Date: Mon, 24 Oct 2022 13:31:18 +0200	[thread overview]
Message-ID: <20221024112935.061892355@linuxfoundation.org> (raw)
In-Reply-To: <20221024112934.415391158@linuxfoundation.org>

From: Ard Biesheuvel <ardb@kernel.org>

commit 4b017e59f01097f19b938f6dc4dc2c4720701610 upstream.

Amadeusz reports KASAN use-after-free errors introduced by commit
3881ee0b1edc ("efi: avoid efivars layer when loading SSDTs from
variables"). The problem appears to be that the memory that holds the
new ACPI table is now freed unconditionally, instead of only when the
ACPI core reported a failure to load the table.

So let's fix this, by omitting the kfree() on success.

Cc: <stable@vger.kernel.org> # v6.0
Link: https://lore.kernel.org/all/a101a10a-4fbb-5fae-2e3c-76cf96ed8fbd@linux.intel.com/
Fixes: 3881ee0b1edc ("efi: avoid efivars layer when loading SSDTs from variables")
Reported-by: Amadeusz Sławiński <amadeuszx.slawinski@linux.intel.com>
Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/firmware/efi/efi.c |    2 ++
 1 file changed, 2 insertions(+)

--- a/drivers/firmware/efi/efi.c
+++ b/drivers/firmware/efi/efi.c
@@ -269,6 +269,8 @@ static __init int efivar_ssdt_load(void)
 			acpi_status ret = acpi_load_table(data, NULL);
 			if (ret)
 				pr_err("failed to load table: %u\n", ret);
+			else
+				continue;
 		} else {
 			pr_err("failed to get var data: 0x%lx\n", status);
 		}



  parent reply	other threads:[~2022-10-24 11:32 UTC|newest]

Thread overview: 41+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2022-10-24 11:31 [PATCH 6.0 00/20] 6.0.4-rc1 review Greg Kroah-Hartman
2022-10-24 11:31 ` [PATCH 6.0 01/20] drm/i915/bios: Validate fp_timing terminator presence Greg Kroah-Hartman
2022-10-24 11:31 ` [PATCH 6.0 02/20] drm/i915/bios: Use hardcoded fp_timing size for generating LFP data pointers Greg Kroah-Hartman
2022-10-24 11:31 ` [PATCH 6.0 03/20] pinctrl: amd: change dev_warn to dev_dbg for additional feature support Greg Kroah-Hartman
2022-10-24 11:31 ` [PATCH 6.0 04/20] thermal: intel_powerclamp: Use first online CPU as control_cpu Greg Kroah-Hartman
2022-10-24 11:31 ` [PATCH 6.0 05/20] io_uring/net: fail zc send when unsupported by socket Greg Kroah-Hartman
2022-10-24 11:31 ` [PATCH 6.0 06/20] HID: playstation: stop DualSense output work on remove Greg Kroah-Hartman
2022-10-24 11:31 ` [PATCH 6.0 07/20] HID: playstation: add initial DualSense Edge controller support Greg Kroah-Hartman
2022-10-24 11:31 ` [PATCH 6.0 08/20] net: flag sockets supporting msghdr originated zerocopy Greg Kroah-Hartman
2022-10-24 11:31 ` [PATCH 6.0 09/20] drm/amd/pm: fulfill SMU13.0.7 cstate control interface Greg Kroah-Hartman
2022-10-24 11:31 ` [PATCH 6.0 10/20] drm/amd/pm: add SMU IP v13.0.4 IF version define to V7 Greg Kroah-Hartman
2022-10-24 11:31 ` [PATCH 6.0 11/20] drm/amd/pm: disable cstate feature for gpu reset scenario Greg Kroah-Hartman
2022-10-24 11:31 ` [PATCH 6.0 12/20] drm/amd/pm: fulfill SMU13.0.0 cstate control interface Greg Kroah-Hartman
2022-10-24 11:31 ` [PATCH 6.0 13/20] drm/amd/pm: update SMU IP v13.0.4 driver interface version Greg Kroah-Hartman
2022-10-24 11:31 ` [PATCH 6.0 14/20] dm clone: Fix typo in block_device format specifier Greg Kroah-Hartman
2022-10-24 11:31 ` [PATCH 6.0 15/20] efi: efivars: Fix variable writes without query_variable_store() Greg Kroah-Hartman
2022-10-24 11:31 ` Greg Kroah-Hartman [this message]
2022-10-24 11:31 ` [PATCH 6.0 17/20] gcov: support GCC 12.1 and newer compilers Greg Kroah-Hartman
2022-10-24 11:31 ` [PATCH 6.0 18/20] io-wq: Fix memory leak in worker creation Greg Kroah-Hartman
2022-10-24 11:31 ` [PATCH 6.0 19/20] mm/huge_memory: do not clobber swp_entry_t during THP split Greg Kroah-Hartman
2022-10-25 15:11   ` Hugh Dickins
2022-10-25 15:58     ` Greg Kroah-Hartman
2022-10-30  3:33       ` Hugh Dickins
2022-10-31  6:44         ` Greg Kroah-Hartman
2022-10-24 11:31 ` [PATCH 6.0 20/20] fbdev/core: Remove remove_conflicting_pci_framebuffers() Greg Kroah-Hartman
2022-11-01  8:42   ` Boris V.
2022-11-01 10:34     ` Thomas Zimmermann
2022-11-01 11:34       ` Boris V.
2022-10-24 15:47 ` [PATCH 6.0 00/20] 6.0.4-rc1 review Luna Jernberg
2022-10-24 19:10 ` Rudi Heitbaum
2022-10-24 19:21 ` Jon Hunter
2022-10-24 19:28 ` Florian Fainelli
2022-10-24 20:48 ` Shuah Khan
2022-10-24 21:55 ` Ron Economos
2022-10-25  0:20 ` Slade Watkins
2022-10-25  9:08 ` Bagas Sanjaya
2022-10-25 12:33 ` Naresh Kamboju
2022-10-25 15:32 ` Guenter Roeck
2022-10-25 22:43 ` Justin Forbes
2022-10-26  6:36 ` Ernst Herzberg
2022-10-26  6:59   ` Greg Kroah-Hartman

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20221024112935.061892355@linuxfoundation.org \
    --to=gregkh@linuxfoundation.org \
    --cc=amadeuszx.slawinski@linux.intel.com \
    --cc=ardb@kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=stable@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox