superrob1500
/
mirror-linux
mirror of https://github.com/torvalds/linux
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

EFI fixes for v6.17 #1 

- Assorted fixes for the OP-TEE based pseudo-EFI variable store
 
 - Fix for an OOB access when looking up the same non-existing efivarfs
   entry multiple times in parallel
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQQQm/3uucuRGn1Dmh0wbglWLn0tXAUCaLB4SAAKCRAwbglWLn0t
 XGgxAP470VOmdXTwEqaTLBfsyKnMZt417F3JkMmY85qdU/tzjwEAvVdQiLN8p5Ng
 4TAHVmkvnZ3vQ87iYVepHImapc56NgI=
 =fPk1
 -----END PGP SIGNATURE-----

Merge tag 'efi-fixes-for-v6.17-1' of git://git.kernel.org/pub/scm/linux/kernel/git/efi/efi

Pull EFI fixes from Ard Biesheuvel:

 - Assorted fixes for the OP-TEE based pseudo-EFI variable store

 - Fix for an OOB access when looking up the same non-existing efivarfs
   entry multiple times in parallel

* tag 'efi-fixes-for-v6.17-1' of git://git.kernel.org/pub/scm/linux/kernel/git/efi/efi:
  efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare
  efi: stmm: Drop unneeded null pointer check
  efi: stmm: Drop unused EFI error from setup_mm_hdr arguments
  efi: stmm: Do not return EFI_OUT_OF_RESOURCES on internal errors
  efi: stmm: Fix incorrect buffer allocation method
pull/1334/head
Linus Torvalds 2025-08-29 09:15:46 -07:00
parent 2575e638e2 a6358f8cf6
commit fb679c832b
2 changed files with 31 additions and 34 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

59
drivers/firmware/efi/stmm/tee_stmm_efi.c
View File

@ -143,6 +143,10 @@ static efi_status_t mm_communicate(u8 *comm_buf, size_t payload_size)
return var_hdr->ret_status; return var_hdr->ret_status;
} }
#define COMM_BUF_SIZE(__payload_size) (MM_COMMUNICATE_HEADER_SIZE + \
MM_VARIABLE_COMMUNICATE_SIZE + \
(__payload_size))
/** /**
* setup_mm_hdr() - Allocate a buffer for StandAloneMM and initialize the * setup_mm_hdr() - Allocate a buffer for StandAloneMM and initialize the
* header data. * header data.
@ -150,11 +154,9 @@ static efi_status_t mm_communicate(u8 *comm_buf, size_t payload_size)
* @dptr: pointer address to store allocated buffer * @dptr: pointer address to store allocated buffer
* @payload_size: payload size * @payload_size: payload size
* @func: standAloneMM function number * @func: standAloneMM function number
* @ret: EFI return code
* Return: pointer to corresponding StandAloneMM function buffer or NULL * Return: pointer to corresponding StandAloneMM function buffer or NULL
*/ */
static void *setup_mm_hdr(u8 **dptr, size_t payload_size, size_t func, static void *setup_mm_hdr(u8 **dptr, size_t payload_size, size_t func)
efi_status_t *ret)
{ {
const efi_guid_t mm_var_guid = EFI_MM_VARIABLE_GUID; const efi_guid_t mm_var_guid = EFI_MM_VARIABLE_GUID;
struct efi_mm_communicate_header *mm_hdr; struct efi_mm_communicate_header *mm_hdr;
@ -169,17 +171,13 @@ static void *setup_mm_hdr(u8 **dptr, size_t payload_size, size_t func,
if (max_buffer_size && if (max_buffer_size &&
max_buffer_size < (MM_COMMUNICATE_HEADER_SIZE + max_buffer_size < (MM_COMMUNICATE_HEADER_SIZE +
MM_VARIABLE_COMMUNICATE_SIZE + payload_size)) { MM_VARIABLE_COMMUNICATE_SIZE + payload_size)) {
*ret = EFI_INVALID_PARAMETER;
return NULL; return NULL;
} }
comm_buf = kzalloc(MM_COMMUNICATE_HEADER_SIZE + comm_buf = alloc_pages_exact(COMM_BUF_SIZE(payload_size),
MM_VARIABLE_COMMUNICATE_SIZE + payload_size, GFP_KERNEL | __GFP_ZERO);
GFP_KERNEL); if (!comm_buf)
if (!comm_buf) {
*ret = EFI_OUT_OF_RESOURCES;
return NULL; return NULL;
}
mm_hdr = (struct efi_mm_communicate_header *)comm_buf; mm_hdr = (struct efi_mm_communicate_header *)comm_buf;
memcpy(&mm_hdr->header_guid, &mm_var_guid, sizeof(mm_hdr->header_guid)); memcpy(&mm_hdr->header_guid, &mm_var_guid, sizeof(mm_hdr->header_guid));
@ -187,9 +185,7 @@ static void *setup_mm_hdr(u8 **dptr, size_t payload_size, size_t func,
var_hdr = (struct smm_variable_communicate_header *)mm_hdr->data; var_hdr = (struct smm_variable_communicate_header *)mm_hdr->data;
var_hdr->function = func; var_hdr->function = func;
if (dptr)
*dptr = comm_buf; *dptr = comm_buf;
*ret = EFI_SUCCESS;
return var_hdr->data; return var_hdr->data;
} }
@ -212,10 +208,9 @@ static efi_status_t get_max_payload(size_t *size)
payload_size = sizeof(*var_payload); payload_size = sizeof(*var_payload);
var_payload = setup_mm_hdr(&comm_buf, payload_size, var_payload = setup_mm_hdr(&comm_buf, payload_size,
SMM_VARIABLE_FUNCTION_GET_PAYLOAD_SIZE, SMM_VARIABLE_FUNCTION_GET_PAYLOAD_SIZE);
&ret);
if (!var_payload) if (!var_payload)
return EFI_OUT_OF_RESOURCES; return EFI_DEVICE_ERROR;
ret = mm_communicate(comm_buf, payload_size); ret = mm_communicate(comm_buf, payload_size);
if (ret != EFI_SUCCESS) if (ret != EFI_SUCCESS)
@ -239,7 +234,7 @@ static efi_status_t get_max_payload(size_t *size)
*/ */
*size -= 2; *size -= 2;
out: out:
kfree(comm_buf); free_pages_exact(comm_buf, COMM_BUF_SIZE(payload_size));
return ret; return ret;
} }
@ -259,9 +254,9 @@ static efi_status_t get_property_int(u16 *name, size_t name_size,
smm_property = setup_mm_hdr( smm_property = setup_mm_hdr(
&comm_buf, payload_size, &comm_buf, payload_size,
SMM_VARIABLE_FUNCTION_VAR_CHECK_VARIABLE_PROPERTY_GET, &ret); SMM_VARIABLE_FUNCTION_VAR_CHECK_VARIABLE_PROPERTY_GET);
if (!smm_property) if (!smm_property)
return EFI_OUT_OF_RESOURCES; return EFI_DEVICE_ERROR;
memcpy(&smm_property->guid, vendor, sizeof(smm_property->guid)); memcpy(&smm_property->guid, vendor, sizeof(smm_property->guid));
smm_property->name_size = name_size; smm_property->name_size = name_size;
@ -282,7 +277,7 @@ static efi_status_t get_property_int(u16 *name, size_t name_size,
memcpy(var_property, &smm_property->property, sizeof(*var_property)); memcpy(var_property, &smm_property->property, sizeof(*var_property));
out: out:
kfree(comm_buf); free_pages_exact(comm_buf, COMM_BUF_SIZE(payload_size));
return ret; return ret;
} }
@ -315,9 +310,9 @@ static efi_status_t tee_get_variable(u16 *name, efi_guid_t *vendor,
payload_size = MM_VARIABLE_ACCESS_HEADER_SIZE + name_size + tmp_dsize; payload_size = MM_VARIABLE_ACCESS_HEADER_SIZE + name_size + tmp_dsize;
var_acc = setup_mm_hdr(&comm_buf, payload_size, var_acc = setup_mm_hdr(&comm_buf, payload_size,
SMM_VARIABLE_FUNCTION_GET_VARIABLE, &ret); SMM_VARIABLE_FUNCTION_GET_VARIABLE);
if (!var_acc) if (!var_acc)
return EFI_OUT_OF_RESOURCES; return EFI_DEVICE_ERROR;
/* Fill in contents */ /* Fill in contents */
memcpy(&var_acc->guid, vendor, sizeof(var_acc->guid)); memcpy(&var_acc->guid, vendor, sizeof(var_acc->guid));
@ -347,7 +342,7 @@ static efi_status_t tee_get_variable(u16 *name, efi_guid_t *vendor,
memcpy(data, (u8 *)var_acc->name + var_acc->name_size, memcpy(data, (u8 *)var_acc->name + var_acc->name_size,
var_acc->data_size); var_acc->data_size);
out: out:
kfree(comm_buf); free_pages_exact(comm_buf, COMM_BUF_SIZE(payload_size));
return ret; return ret;
} }
@ -380,10 +375,9 @@ static efi_status_t tee_get_next_variable(unsigned long *name_size,
payload_size = MM_VARIABLE_GET_NEXT_HEADER_SIZE + out_name_size; payload_size = MM_VARIABLE_GET_NEXT_HEADER_SIZE + out_name_size;
var_getnext = setup_mm_hdr(&comm_buf, payload_size, var_getnext = setup_mm_hdr(&comm_buf, payload_size,
SMM_VARIABLE_FUNCTION_GET_NEXT_VARIABLE_NAME, SMM_VARIABLE_FUNCTION_GET_NEXT_VARIABLE_NAME);
&ret);
if (!var_getnext) if (!var_getnext)
return EFI_OUT_OF_RESOURCES; return EFI_DEVICE_ERROR;
/* Fill in contents */ /* Fill in contents */
memcpy(&var_getnext->guid, guid, sizeof(var_getnext->guid)); memcpy(&var_getnext->guid, guid, sizeof(var_getnext->guid));
@ -404,7 +398,7 @@ static efi_status_t tee_get_next_variable(unsigned long *name_size,
memcpy(name, var_getnext->name, var_getnext->name_size); memcpy(name, var_getnext->name, var_getnext->name_size);
out: out:
kfree(comm_buf); free_pages_exact(comm_buf, COMM_BUF_SIZE(payload_size));
return ret; return ret;
} }
@ -437,9 +431,9 @@ static efi_status_t tee_set_variable(efi_char16_t *name, efi_guid_t *vendor,
* the properties, if the allocation fails * the properties, if the allocation fails
*/ */
var_acc = setup_mm_hdr(&comm_buf, payload_size, var_acc = setup_mm_hdr(&comm_buf, payload_size,
SMM_VARIABLE_FUNCTION_SET_VARIABLE, &ret); SMM_VARIABLE_FUNCTION_SET_VARIABLE);
if (!var_acc) if (!var_acc)
return EFI_OUT_OF_RESOURCES; return EFI_DEVICE_ERROR;
/* /*
* The API has the ability to override RO flags. If no RO check was * The API has the ability to override RO flags. If no RO check was
@ -467,7 +461,7 @@ static efi_status_t tee_set_variable(efi_char16_t *name, efi_guid_t *vendor,
ret = mm_communicate(comm_buf, payload_size); ret = mm_communicate(comm_buf, payload_size);
dev_dbg(pvt_data.dev, "Set Variable %s %d %lx\n", __FILE__, __LINE__, ret); dev_dbg(pvt_data.dev, "Set Variable %s %d %lx\n", __FILE__, __LINE__, ret);
out: out:
kfree(comm_buf); free_pages_exact(comm_buf, COMM_BUF_SIZE(payload_size));
return ret; return ret;
} }
@ -492,10 +486,9 @@ static efi_status_t tee_query_variable_info(u32 attributes,
payload_size = sizeof(*mm_query_info); payload_size = sizeof(*mm_query_info);
mm_query_info = setup_mm_hdr(&comm_buf, payload_size, mm_query_info = setup_mm_hdr(&comm_buf, payload_size,
SMM_VARIABLE_FUNCTION_QUERY_VARIABLE_INFO, SMM_VARIABLE_FUNCTION_QUERY_VARIABLE_INFO);
&ret);
if (!mm_query_info) if (!mm_query_info)
return EFI_OUT_OF_RESOURCES; return EFI_DEVICE_ERROR;
mm_query_info->attr = attributes; mm_query_info->attr = attributes;
ret = mm_communicate(comm_buf, payload_size); ret = mm_communicate(comm_buf, payload_size);
@ -507,7 +500,7 @@ static efi_status_t tee_query_variable_info(u32 attributes,
*max_variable_size = mm_query_info->max_variable_size; *max_variable_size = mm_query_info->max_variable_size;
out: out:
kfree(comm_buf); free_pages_exact(comm_buf, COMM_BUF_SIZE(payload_size));
return ret; return ret;
} }

4
fs/efivarfs/super.c
View File

@ -152,6 +152,10 @@ static int efivarfs_d_compare(const struct dentry *dentry,
{ {
int guid = len - EFI_VARIABLE_GUID_LEN; int guid = len - EFI_VARIABLE_GUID_LEN;
/* Parallel lookups may produce a temporary invalid filename */
if (guid <= 0)
return 1;
if (name->len != len) if (name->len != len)
return 1; return 1;