Skip to content

Commit

Permalink
x86/boot: Fix memremap of setup_indirect structures
Browse files Browse the repository at this point in the history 
As documented, the setup_indirect structure is nested inside
the setup_data structures in the setup_data list. The code currently
accesses the fields inside the setup_indirect structure but only
the sizeof(struct setup_data) is being memremapped. No crash
occurred but this is just due to how the area is remapped under the
covers.

Properly memremap both the setup_data and setup_indirect structures
in these cases before accessing them.

Fixes: b3c72fc ("x86/boot: Introduce setup_indirect")
Signed-off-by: Ross Philipson <ross.philipson@oracle.com>
Signed-off-by: Borislav Petkov <bp@suse.de>
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/1645668456-22036-2-git-send-email-ross.philipson@oracle.com
  • Loading branch information
@rossphilipson
rossphilipson authored and Borislav Petkov committed Mar 9, 2022
1 parent 5adf349 commit 7228918
Show file tree
Hide file tree
Showing 5 changed files with 166 additions and 47 deletions.
41 changes: 30 additions & 11 deletions arch/x86/kernel/e820.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -995,15 +995,25 @@ early_param("memmap", parse_memmap_opt);
*/
void __init e820__reserve_setup_data(void)
{
struct setup_indirect *indirect;
struct setup_data *data;
u64 pa_data;
u64 pa_data, pa_next;
u32 len;

pa_data = boot_params.hdr.setup_data;
if (!pa_data)
return;

while (pa_data) {
data = early_memremap(pa_data, sizeof(*data));
if (!data) {
pr_warn("e820: failed to memremap setup_data entry\n");
return;
}

len = sizeof(*data);
pa_next = data->next;

e820__range_update(pa_data, sizeof(*data)+data->len, E820_TYPE_RAM, E820_TYPE_RESERVED_KERN);

/*
Expand All @@ -1015,18 +1025,27 @@ void __init e820__reserve_setup_data(void)
sizeof(*data) + data->len,
E820_TYPE_RAM, E820_TYPE_RESERVED_KERN);

if (data->type == SETUP_INDIRECT &&
((struct setup_indirect *)data->data)->type != SETUP_INDIRECT) {
e820__range_update(((struct setup_indirect *)data->data)->addr,
((struct setup_indirect *)data->data)->len,
E820_TYPE_RAM, E820_TYPE_RESERVED_KERN);
e820__range_update_kexec(((struct setup_indirect *)data->data)->addr,
((struct setup_indirect *)data->data)->len,
E820_TYPE_RAM, E820_TYPE_RESERVED_KERN);
if (data->type == SETUP_INDIRECT) {
len += data->len;
early_memunmap(data, sizeof(*data));
data = early_memremap(pa_data, len);
if (!data) {
pr_warn("e820: failed to memremap indirect setup_data\n");
return;
}

indirect = (struct setup_indirect *)data->data;

if (indirect->type != SETUP_INDIRECT) {
e820__range_update(indirect->addr, indirect->len,
E820_TYPE_RAM, E820_TYPE_RESERVED_KERN);
e820__range_update_kexec(indirect->addr, indirect->len,
E820_TYPE_RAM, E820_TYPE_RESERVED_KERN);
}
}

pa_data = data->next;
early_memunmap(data, sizeof(*data));
pa_data = pa_next;
early_memunmap(data, len);
}

e820__update_table(e820_table);
Expand Down
37 changes: 28 additions & 9 deletions arch/x86/kernel/kdebugfs.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -88,11 +88,13 @@ create_setup_data_node(struct dentry *parent, int no,

static int __init create_setup_data_nodes(struct dentry *parent)
{
struct setup_indirect *indirect;
struct setup_data_node *node;
struct setup_data *data;
int error;
u64 pa_data, pa_next;
struct dentry *d;
u64 pa_data;
int error;
u32 len;
int no = 0;

d = debugfs_create_dir("setup_data", parent);
Expand All @@ -112,20 +114,37 @@ static int __init create_setup_data_nodes(struct dentry *parent)
error = -ENOMEM;
goto err_dir;
}

if (data->type == SETUP_INDIRECT &&
((struct setup_indirect *)data->data)->type != SETUP_INDIRECT) {
node->paddr = ((struct setup_indirect *)data->data)->addr;
node->type = ((struct setup_indirect *)data->data)->type;
node->len = ((struct setup_indirect *)data->data)->len;
pa_next = data->next;

if (data->type == SETUP_INDIRECT) {
len = sizeof(*data) + data->len;
memunmap(data);
data = memremap(pa_data, len, MEMREMAP_WB);
if (!data) {
kfree(node);
error = -ENOMEM;
goto err_dir;
}

indirect = (struct setup_indirect *)data->data;

if (indirect->type != SETUP_INDIRECT) {
node->paddr = indirect->addr;
node->type = indirect->type;
node->len = indirect->len;
} else {
node->paddr = pa_data;
node->type = data->type;
node->len = data->len;
}
} else {
node->paddr = pa_data;
node->type = data->type;
node->len = data->len;
}

create_setup_data_node(d, no, node);
pa_data = data->next;
pa_data = pa_next;

memunmap(data);
no++;
Expand Down
77 changes: 61 additions & 16 deletions arch/x86/kernel/ksysfs.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -91,26 +91,41 @@ static int get_setup_data_paddr(int nr, u64 *paddr)

static int __init get_setup_data_size(int nr, size_t *size)
{
int i = 0;
u64 pa_data = boot_params.hdr.setup_data, pa_next;
struct setup_indirect *indirect;
struct setup_data *data;
u64 pa_data = boot_params.hdr.setup_data;
int i = 0;
u32 len;

while (pa_data) {
data = memremap(pa_data, sizeof(*data), MEMREMAP_WB);
if (!data)
return -ENOMEM;
pa_next = data->next;

if (nr == i) {
if (data->type == SETUP_INDIRECT &&
((struct setup_indirect *)data->data)->type != SETUP_INDIRECT)
*size = ((struct setup_indirect *)data->data)->len;
else
if (data->type == SETUP_INDIRECT) {
len = sizeof(*data) + data->len;
memunmap(data);
data = memremap(pa_data, len, MEMREMAP_WB);
if (!data)
return -ENOMEM;

indirect = (struct setup_indirect *)data->data;

if (indirect->type != SETUP_INDIRECT)
*size = indirect->len;
else
*size = data->len;
} else {
*size = data->len;
}

memunmap(data);
return 0;
}

pa_data = data->next;
pa_data = pa_next;
memunmap(data);
i++;
}
Expand All @@ -120,9 +135,11 @@ static int __init get_setup_data_size(int nr, size_t *size)
static ssize_t type_show(struct kobject *kobj,
struct kobj_attribute *attr, char *buf)
{
struct setup_indirect *indirect;
struct setup_data *data;
int nr, ret;
u64 paddr;
struct setup_data *data;
u32 len;

ret = kobj_to_setup_data_nr(kobj, &nr);
if (ret)
Expand All @@ -135,10 +152,20 @@ static ssize_t type_show(struct kobject *kobj,
if (!data)
return -ENOMEM;

if (data->type == SETUP_INDIRECT)
ret = sprintf(buf, "0x%x\n", ((struct setup_indirect *)data->data)->type);
else
if (data->type == SETUP_INDIRECT) {
len = sizeof(*data) + data->len;
memunmap(data);
data = memremap(paddr, len, MEMREMAP_WB);
if (!data)
return -ENOMEM;

indirect = (struct setup_indirect *)data->data;

ret = sprintf(buf, "0x%x\n", indirect->type);
} else {
ret = sprintf(buf, "0x%x\n", data->type);
}

memunmap(data);
return ret;
}
Expand All @@ -149,9 +176,10 @@ static ssize_t setup_data_data_read(struct file *fp,
char *buf,
loff_t off, size_t count)
{
struct setup_indirect *indirect;
struct setup_data *data;
int nr, ret = 0;
u64 paddr, len;
struct setup_data *data;
void *p;

ret = kobj_to_setup_data_nr(kobj, &nr);
Expand All @@ -165,10 +193,27 @@ static ssize_t setup_data_data_read(struct file *fp,
if (!data)
return -ENOMEM;

if (data->type == SETUP_INDIRECT &&
((struct setup_indirect *)data->data)->type != SETUP_INDIRECT) {
paddr = ((struct setup_indirect *)data->data)->addr;
len = ((struct setup_indirect *)data->data)->len;
if (data->type == SETUP_INDIRECT) {
len = sizeof(*data) + data->len;
memunmap(data);
data = memremap(paddr, len, MEMREMAP_WB);
if (!data)
return -ENOMEM;

indirect = (struct setup_indirect *)data->data;

if (indirect->type != SETUP_INDIRECT) {
paddr = indirect->addr;
len = indirect->len;
} else {
/*
* Even though this is technically undefined, return
* the data as though it is a normal setup_data struct.
* This will at least allow it to be inspected.
*/
paddr += sizeof(*data);
len = data->len;
}
} else {
paddr += sizeof(*data);
len = data->len;
Expand Down
34 changes: 27 additions & 7 deletions arch/x86/kernel/setup.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -369,21 +369,41 @@ static void __init parse_setup_data(void)

static void __init memblock_x86_reserve_range_setup_data(void)
{
struct setup_indirect *indirect;
struct setup_data *data;
u64 pa_data;
u64 pa_data, pa_next;
u32 len;

pa_data = boot_params.hdr.setup_data;
while (pa_data) {
data = early_memremap(pa_data, sizeof(*data));
if (!data) {
pr_warn("setup: failed to memremap setup_data entry\n");
return;
}

len = sizeof(*data);
pa_next = data->next;

memblock_reserve(pa_data, sizeof(*data) + data->len);

if (data->type == SETUP_INDIRECT &&
((struct setup_indirect *)data->data)->type != SETUP_INDIRECT)
memblock_reserve(((struct setup_indirect *)data->data)->addr,
((struct setup_indirect *)data->data)->len);
if (data->type == SETUP_INDIRECT) {
len += data->len;
early_memunmap(data, sizeof(*data));
data = early_memremap(pa_data, len);
if (!data) {
pr_warn("setup: failed to memremap indirect setup_data\n");
return;
}

pa_data = data->next;
early_memunmap(data, sizeof(*data));
indirect = (struct setup_indirect *)data->data;

if (indirect->type != SETUP_INDIRECT)
memblock_reserve(indirect->addr, indirect->len);
}

pa_data = pa_next;
early_memunmap(data, len);
}
}

Expand Down
24 changes: 20 additions & 4 deletions arch/x86/mm/ioremap.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -615,6 +615,7 @@ static bool memremap_is_efi_data(resource_size_t phys_addr,
static bool memremap_is_setup_data(resource_size_t phys_addr,
unsigned long size)
{
struct setup_indirect *indirect;
struct setup_data *data;
u64 paddr, paddr_next;

Expand All @@ -627,6 +628,10 @@ static bool memremap_is_setup_data(resource_size_t phys_addr,

data = memremap(paddr, sizeof(*data),
MEMREMAP_WB | MEMREMAP_DEC);
if (!data) {
pr_warn("failed to memremap setup_data entry\n");
return false;
}

paddr_next = data->next;
len = data->len;
Expand All @@ -636,10 +641,21 @@ static bool memremap_is_setup_data(resource_size_t phys_addr,
return true;
}

if (data->type == SETUP_INDIRECT &&
((struct setup_indirect *)data->data)->type != SETUP_INDIRECT) {
paddr = ((struct setup_indirect *)data->data)->addr;
len = ((struct setup_indirect *)data->data)->len;
if (data->type == SETUP_INDIRECT) {
memunmap(data);
data = memremap(paddr, sizeof(*data) + len,
MEMREMAP_WB | MEMREMAP_DEC);
if (!data) {
pr_warn("failed to memremap indirect setup_data\n");
return false;
}

indirect = (struct setup_indirect *)data->data;

if (indirect->type != SETUP_INDIRECT) {
paddr = indirect->addr;
len = indirect->len;
}
}

memunmap(data);
Expand Down

0 comments on commit 7228918

Please sign in to comment.