mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-10-29 23:53:32 +00:00
firmware/efi: Fix a use after bug in efi_mem_reserve_persistent
commit9ceee7d084
upstream. In the for loop in efi_mem_reserve_persistent(), prsv = rsv->next use the unmapped rsv. Use the unmapped pages will cause segment fault. Fixes:18df7577ad
("efi/memreserve: deal with memreserve entries in unmapped memory") Signed-off-by: Lv Yunlong <lyl2019@mail.ustc.edu.cn> Signed-off-by: Ard Biesheuvel <ardb@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
parent
31e17169a1
commit
b8ebe853ab
1 changed files with 2 additions and 1 deletions
|
@ -1006,7 +1006,7 @@ int __ref efi_mem_reserve_persistent(phys_addr_t addr, u64 size)
|
|||
}
|
||||
|
||||
/* first try to find a slot in an existing linked list entry */
|
||||
for (prsv = efi_memreserve_root->next; prsv; prsv = rsv->next) {
|
||||
for (prsv = efi_memreserve_root->next; prsv; ) {
|
||||
rsv = memremap(prsv, sizeof(*rsv), MEMREMAP_WB);
|
||||
index = atomic_fetch_add_unless(&rsv->count, 1, rsv->size);
|
||||
if (index < rsv->size) {
|
||||
|
@ -1016,6 +1016,7 @@ int __ref efi_mem_reserve_persistent(phys_addr_t addr, u64 size)
|
|||
memunmap(rsv);
|
||||
return efi_mem_reserve_iomem(addr, size);
|
||||
}
|
||||
prsv = rsv->next;
|
||||
memunmap(rsv);
|
||||
}
|
||||
|
||||
|
|
Loading…
Reference in a new issue