kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-09-28 19:20:30 +00:00
Code Issues Releases Packages Activity
linux/drivers/firmware/efi
History
Dave Young 792ef14df5 efi: Fix boot panic because of invalid BGRT image address 
Maniaxx reported a kernel boot crash in the EFI code, which I emulated
by using same invalid phys addr in code:

  BUG: unable to handle kernel paging request at ffffffffff280001
  IP: efi_bgrt_init+0xfb/0x153
  ...
  Call Trace:
   ? bgrt_init+0xbc/0xbc
   acpi_parse_bgrt+0xe/0x12
   acpi_table_parse+0x89/0xb8
   acpi_boot_init+0x445/0x4e2
   ? acpi_parse_x2apic+0x79/0x79
   ? dmi_ignore_irq0_timer_override+0x33/0x33
   setup_arch+0xb63/0xc82
   ? early_idt_handler_array+0x120/0x120
   start_kernel+0xb7/0x443
   ? early_idt_handler_array+0x120/0x120
   x86_64_start_reservations+0x29/0x2b
   x86_64_start_kernel+0x154/0x177
   secondary_startup_64+0x9f/0x9f

There is also a similar bug filed in bugzilla.kernel.org:

  https://bugzilla.kernel.org/show_bug.cgi?id=195633

The crash is caused by this commit:

  7b0a911478 efi/x86: Move the EFI BGRT init code to early init code

The root cause is the firmware on those machines provides invalid BGRT
image addresses.

In a kernel before above commit BGRT initializes late and uses ioremap()
to map the image address. Ioremap validates the address, if it is not a
valid physical address ioremap() just fails and returns. However in current
kernel EFI BGRT initializes early and uses early_memremap() which does not
validate the image address, and kernel panic happens.

According to ACPI spec the BGRT image address should fall into
EFI_BOOT_SERVICES_DATA, see the section 5.2.22.4 of below document:

  http://www.uefi.org/sites/default/files/resources/ACPI_6_1.pdf

Fix this issue by validating the image address in efi_bgrt_init(). If the
image address does not fall into any EFI_BOOT_SERVICES_DATA areas we just
bail out with a warning message.

Reported-by: Maniaxx <tripleshiftone@gmail.com>
Signed-off-by: Dave Young <dyoung@redhat.com>
Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Matt Fleming <matt@codeblueprint.co.uk>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: linux-efi@vger.kernel.org
Fixes: 7b0a911478 ("efi/x86: Move the EFI BGRT init code to early init code")
Link: http://lkml.kernel.org/r/20170609084558.26766-2-ard.biesheuvel@linaro.org
Signed-off-by: Ingo Molnar <mingo@kernel.org>
History 2017-06-09 14:50:11 +02:00
..
libstub efi: Remove duplicate 'const' specifiers 2017-05-28 11:06:16 +02:00
test efi/efi_test: Use memdup_user() as a cleanup 2016-10-18 17:11:19 +02:00
apple-properties.c x86/efi: Retrieve and assign Apple device properties 2016-11-13 08:23:16 +01:00
arm-init.c efi: Make EFI_MEMORY_ATTRIBUTES_TABLE initialization common across all architectures 2017-02-01 08:45:43 +01:00
arm-runtime.c efi/arm: Fix boot crash with CONFIG_CPUMASK_OFFSTACK=y 2017-03-02 08:11:19 +01:00
capsule-loader.c efi/capsule: Allocate whole capsule into virtual memory 2016-08-11 13:55:36 +02:00
capsule.c efi/capsule: Allocate whole capsule into virtual memory 2016-08-11 13:55:36 +02:00
cper.c efi: Handle memory error structures produced based on old versions of standard 2015-07-15 13:30:38 +01:00
dev-path-parser.c efi: Add device path parser 2016-11-13 08:23:15 +01:00
efi-bgrt.c efi: Fix boot panic because of invalid BGRT image address 2017-06-09 14:50:11 +02:00
efi-pstore.c More, and hopefully final, fixes after refactor for EFI pstore backend. 2017-05-22 19:31:07 -07:00
efi.c efi/esrt: Cleanup bad memory map log messages 2017-03-17 18:53:12 +00:00
efibc.c efibc: Report more information in the error messages 2016-06-27 13:06:54 +02:00
efivars.c efi: Don't use spinlocks for efi vars 2016-09-09 16:08:42 +01:00
esrt.c efi/esrt: Cleanup bad memory map log messages 2017-03-17 18:53:12 +00:00
fake_mem.c x86/efi: Don't allocate memmap through memblock after mm_init() 2017-01-07 08:58:07 +01:00
Kconfig x86/efi: Retrieve and assign Apple device properties 2016-11-13 08:23:16 +01:00
Makefile x86/efi/bgrt: Move efi-bgrt handling out of arch/x86 2017-04-05 12:27:24 +02:00
memattr.c x86/efi: Add support for EFI_MEMORY_ATTRIBUTES_TABLE 2017-02-01 08:45:44 +01:00
memmap.c x86/efi: Don't allocate memmap through memblock after mm_init() 2017-01-07 08:58:07 +01:00
reboot.c efi: Add 'capsule' update support 2016-04-28 11:34:03 +02:00
runtime-map.c efi/runtime-map: Use efi.memmap directly instead of a copy 2016-09-09 16:08:36 +01:00
runtime-wrappers.c efi: Replace runtime services spinlock with semaphore 2016-09-09 16:08:43 +01:00
vars.c efi: Don't use spinlocks for efi vars 2016-09-09 16:08:42 +01:00