mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-11-01 08:58:07 +00:00
792ef14df5
Maniaxx reported a kernel boot crash in the EFI code, which I emulated by using same invalid phys addr in code: BUG: unable to handle kernel paging request at ffffffffff280001 IP: efi_bgrt_init+0xfb/0x153 ... Call Trace: ? bgrt_init+0xbc/0xbc acpi_parse_bgrt+0xe/0x12 acpi_table_parse+0x89/0xb8 acpi_boot_init+0x445/0x4e2 ? acpi_parse_x2apic+0x79/0x79 ? dmi_ignore_irq0_timer_override+0x33/0x33 setup_arch+0xb63/0xc82 ? early_idt_handler_array+0x120/0x120 start_kernel+0xb7/0x443 ? early_idt_handler_array+0x120/0x120 x86_64_start_reservations+0x29/0x2b x86_64_start_kernel+0x154/0x177 secondary_startup_64+0x9f/0x9f There is also a similar bug filed in bugzilla.kernel.org: https://bugzilla.kernel.org/show_bug.cgi?id=195633 The crash is caused by this commit:7b0a911478efi/x86: Move the EFI BGRT init code to early init code The root cause is the firmware on those machines provides invalid BGRT image addresses. In a kernel before above commit BGRT initializes late and uses ioremap() to map the image address. Ioremap validates the address, if it is not a valid physical address ioremap() just fails and returns. However in current kernel EFI BGRT initializes early and uses early_memremap() which does not validate the image address, and kernel panic happens. According to ACPI spec the BGRT image address should fall into EFI_BOOT_SERVICES_DATA, see the section 5.2.22.4 of below document: http://www.uefi.org/sites/default/files/resources/ACPI_6_1.pdf Fix this issue by validating the image address in efi_bgrt_init(). If the image address does not fall into any EFI_BOOT_SERVICES_DATA areas we just bail out with a warning message. Reported-by: Maniaxx <tripleshiftone@gmail.com> Signed-off-by: Dave Young <dyoung@redhat.com> Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org> Cc: Linus Torvalds <torvalds@linux-foundation.org> Cc: Matt Fleming <matt@codeblueprint.co.uk> Cc: Peter Zijlstra <peterz@infradead.org> Cc: Thomas Gleixner <tglx@linutronix.de> Cc: linux-efi@vger.kernel.org Fixes:7b0a911478("efi/x86: Move the EFI BGRT init code to early init code") Link: http://lkml.kernel.org/r/20170609084558.26766-2-ard.biesheuvel@linaro.org Signed-off-by: Ingo Molnar <mingo@kernel.org>
111 lines
2.6 KiB
C
111 lines
2.6 KiB
C
/*
|
|
* Copyright 2012 Intel Corporation
|
|
* Author: Josh Triplett <josh@joshtriplett.org>
|
|
*
|
|
* Based on the bgrt driver:
|
|
* Copyright 2012 Red Hat, Inc <mjg@redhat.com>
|
|
* Author: Matthew Garrett
|
|
*
|
|
* This program is free software; you can redistribute it and/or modify
|
|
* it under the terms of the GNU General Public License version 2 as
|
|
* published by the Free Software Foundation.
|
|
*/
|
|
|
|
#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
|
|
|
|
#include <linux/kernel.h>
|
|
#include <linux/init.h>
|
|
#include <linux/acpi.h>
|
|
#include <linux/efi.h>
|
|
#include <linux/efi-bgrt.h>
|
|
|
|
struct acpi_table_bgrt bgrt_tab;
|
|
size_t __initdata bgrt_image_size;
|
|
|
|
struct bmp_header {
|
|
u16 id;
|
|
u32 size;
|
|
} __packed;
|
|
|
|
static bool efi_bgrt_addr_valid(u64 addr)
|
|
{
|
|
efi_memory_desc_t *md;
|
|
|
|
for_each_efi_memory_desc(md) {
|
|
u64 size;
|
|
u64 end;
|
|
|
|
if (md->type != EFI_BOOT_SERVICES_DATA)
|
|
continue;
|
|
|
|
size = md->num_pages << EFI_PAGE_SHIFT;
|
|
end = md->phys_addr + size;
|
|
if (addr >= md->phys_addr && addr < end)
|
|
return true;
|
|
}
|
|
|
|
return false;
|
|
}
|
|
|
|
void __init efi_bgrt_init(struct acpi_table_header *table)
|
|
{
|
|
void *image;
|
|
struct bmp_header bmp_header;
|
|
struct acpi_table_bgrt *bgrt = &bgrt_tab;
|
|
|
|
if (acpi_disabled)
|
|
return;
|
|
|
|
if (!efi_enabled(EFI_MEMMAP))
|
|
return;
|
|
|
|
if (table->length < sizeof(bgrt_tab)) {
|
|
pr_notice("Ignoring BGRT: invalid length %u (expected %zu)\n",
|
|
table->length, sizeof(bgrt_tab));
|
|
return;
|
|
}
|
|
*bgrt = *(struct acpi_table_bgrt *)table;
|
|
if (bgrt->version != 1) {
|
|
pr_notice("Ignoring BGRT: invalid version %u (expected 1)\n",
|
|
bgrt->version);
|
|
goto out;
|
|
}
|
|
if (bgrt->status & 0xfe) {
|
|
pr_notice("Ignoring BGRT: reserved status bits are non-zero %u\n",
|
|
bgrt->status);
|
|
goto out;
|
|
}
|
|
if (bgrt->image_type != 0) {
|
|
pr_notice("Ignoring BGRT: invalid image type %u (expected 0)\n",
|
|
bgrt->image_type);
|
|
goto out;
|
|
}
|
|
if (!bgrt->image_address) {
|
|
pr_notice("Ignoring BGRT: null image address\n");
|
|
goto out;
|
|
}
|
|
|
|
if (!efi_bgrt_addr_valid(bgrt->image_address)) {
|
|
pr_notice("Ignoring BGRT: invalid image address\n");
|
|
goto out;
|
|
}
|
|
image = early_memremap(bgrt->image_address, sizeof(bmp_header));
|
|
if (!image) {
|
|
pr_notice("Ignoring BGRT: failed to map image header memory\n");
|
|
goto out;
|
|
}
|
|
|
|
memcpy(&bmp_header, image, sizeof(bmp_header));
|
|
early_memunmap(image, sizeof(bmp_header));
|
|
if (bmp_header.id != 0x4d42) {
|
|
pr_notice("Ignoring BGRT: Incorrect BMP magic number 0x%x (expected 0x4d42)\n",
|
|
bmp_header.id);
|
|
goto out;
|
|
}
|
|
bgrt_image_size = bmp_header.size;
|
|
efi_mem_reserve(bgrt->image_address, bgrt_image_size);
|
|
|
|
return;
|
|
out:
|
|
memset(bgrt, 0, sizeof(bgrt_tab));
|
|
}
|