LKML Archive on lore.kernel.org
help / color / mirror / Atom feed
From: Ard Biesheuvel <ard.biesheuvel@linaro.org>
To: linux-efi@vger.kernel.org, Ingo Molnar <mingo@kernel.org>,
	Thomas Gleixner <tglx@linutronix.de>
Cc: Hans de Goede <hdegoede@redhat.com>,
	Ard Biesheuvel <ard.biesheuvel@linaro.org>,
	linux-kernel@vger.kernel.org
Subject: [PATCH 15/17] efi/x86: Ignore unrealistically large option roms
Date: Fri,  4 May 2018 08:00:01 +0200	[thread overview]
Message-ID: <20180504060003.19618-16-ard.biesheuvel@linaro.org> (raw)
In-Reply-To: <20180504060003.19618-1-ard.biesheuvel@linaro.org>

From: Hans de Goede <hdegoede@redhat.com>

setup_efi_pci() tries to save a copy of each PCI option ROM as this may
be necessary for the device driver for the PCI device to have access too.

On some systems the efi_pci_io_protocol's romimage and romsize fields
contain invalid data, which looks a bit like pointers pointing back into
other EFI code or data. Interpreting these pointers as romsize leads to
a very large value and if we then try to alloc this amount of memory to
save a copy the alloc call fails.

This leads to a "Failed to alloc mem for rom" error being printed on the
EFI console for each PCI device.

This commit avoids the printing of these errors, by checking romsize before
doing the alloc and if it is larger then the EFI spec limit of 16 MiB
silently ignore the ROM fields instead of trying to alloc mem and fail.

Signed-off-by: Hans de Goede <hdegoede@redhat.com>
[ardb: deduplicate 32/64 bit changes, use SZ_16M symbolic constant]
Tested-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
---
 arch/x86/boot/compressed/eboot.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/arch/x86/boot/compressed/eboot.c b/arch/x86/boot/compressed/eboot.c
index dadf32312082..720b06e86698 100644
--- a/arch/x86/boot/compressed/eboot.c
+++ b/arch/x86/boot/compressed/eboot.c
@@ -123,10 +123,17 @@ __setup_efi_pci(efi_pci_io_protocol_t *pci, struct pci_setup_rom **__rom)
 	if (status != EFI_SUCCESS)
 		return status;
 
+	/*
+	 * Some firmwares contain EFI function pointers at the place where the
+	 * romimage and romsize fields are supposed to be. Typically the EFI
+	 * code is mapped at high addresses, translating to an unrealistically
+	 * large romsize. The UEFI spec limits the size of option ROMs to 16
+	 * MiB so we reject any roms over 16 MiB in size to catch this.
+	 */
 	romimage = (void *)(unsigned long)efi_table_attr(efi_pci_io_protocol,
 							 romimage, pci);
 	romsize = efi_table_attr(efi_pci_io_protocol, romsize, pci);
-	if (!romimage || !romsize)
+	if (!romimage || !romsize || romsize > SZ_16M)
 		return EFI_INVALID_PARAMETER;
 
 	size = romsize + sizeof(*rom);
-- 
2.17.0

  parent reply	other threads:[~2018-05-04  6:02 UTC|newest]

Thread overview: 47+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2018-05-04  5:59 [GIT PULL 00/17] EFI updates for v4.18 Ard Biesheuvel
2018-05-04  5:59 ` [PATCH 01/17] x86/xen/efi: Initialize UEFI secure boot state during dom0 boot Ard Biesheuvel
2018-05-14  7:43   ` [tip:efi/core] " tip-bot for Daniel Kiper
2018-05-04  5:59 ` [PATCH 02/17] efi/cper: Remove the INDENT_SP silliness Ard Biesheuvel
2018-05-14  7:44   ` [tip:efi/core] " tip-bot for Borislav Petkov
2018-05-04  5:59 ` [PATCH 03/17] efi: Fix IA32/X64 Processor Error Record definition Ard Biesheuvel
2018-05-14  7:44   ` [tip:efi/core] " tip-bot for Yazen Ghannam
2018-05-04  5:59 ` [PATCH 04/17] efi: Decode IA32/X64 Processor Error Section Ard Biesheuvel
2018-05-14  7:45   ` [tip:efi/core] " tip-bot for Yazen Ghannam
2018-05-04  5:59 ` [PATCH 05/17] efi: Decode IA32/X64 Processor Error Info Structure Ard Biesheuvel
2018-05-14  7:45   ` [tip:efi/core] " tip-bot for Yazen Ghannam
2018-05-04  5:59 ` [PATCH 06/17] efi: Decode UEFI-defined IA32/X64 Error Structure GUIDs Ard Biesheuvel
2018-05-14  7:46   ` [tip:efi/core] " tip-bot for Yazen Ghannam
2018-05-04  5:59 ` [PATCH 07/17] efi: Decode IA32/X64 Cache, TLB, and Bus Check structures Ard Biesheuvel
2018-05-14  7:46   ` [tip:efi/core] " tip-bot for Yazen Ghannam
2018-05-04  5:59 ` [PATCH 08/17] efi: Decode additional IA32/X64 Bus Check fields Ard Biesheuvel
2018-05-14  7:47   ` [tip:efi/core] " tip-bot for Yazen Ghannam
2018-05-04  5:59 ` [PATCH 09/17] efi: Decode IA32/X64 MS Check structure Ard Biesheuvel
2018-05-14  7:47   ` [tip:efi/core] " tip-bot for Yazen Ghannam
2018-05-04  5:59 ` [PATCH 10/17] efi: Decode IA32/X64 Context Info structure Ard Biesheuvel
2018-05-14  7:48   ` [tip:efi/core] " tip-bot for Yazen Ghannam
2018-05-04  5:59 ` [PATCH 11/17] efi/libstub/tpm: Make function efi_retrieve_tpm2_eventlog_1_2() static Ard Biesheuvel
2018-05-14  7:48   ` [tip:efi/core] " tip-bot for Wei Yongjun
2018-05-04  5:59 ` [PATCH 12/17] efi: fix efi_pci_io_protocol32 prototype for mixed mode Ard Biesheuvel
2018-05-14  6:57   ` Ingo Molnar
2018-05-14  7:02     ` Ard Biesheuvel
2018-05-14  7:42   ` [tip:efi/core] efi: Avoid potential crashes, fix the 'struct efi_pci_io_protocol_32' definition " tip-bot for Ard Biesheuvel
2018-05-04  5:59 ` [PATCH 13/17] efi: align efi_pci_io_protocol typedefs to type naming convention Ard Biesheuvel
2018-05-14  7:49   ` [tip:efi/core] efi: Align " tip-bot for Ard Biesheuvel
2018-05-04  6:00 ` [PATCH 14/17] efi/x86: fold __setup_efi_pci32 and __setup_efi_pci64 into one Ard Biesheuvel
2018-05-14  7:49   ` [tip:efi/core] efi/x86: Fold __setup_efi_pci32() and __setup_efi_pci64() into one function tip-bot for Ard Biesheuvel
2018-05-04  6:00 ` Ard Biesheuvel [this message]
2018-05-14  6:40   ` [PATCH 15/17] efi/x86: Ignore unrealistically large option roms Ingo Molnar
2018-05-14  6:43   ` [PATCH] efi/x86: Clean up the eboot code a bit Ingo Molnar
2018-05-14  6:47     ` Ard Biesheuvel
2018-05-14  6:58       ` Ingo Molnar
2018-05-14  6:59         ` Ard Biesheuvel
2018-05-14  7:50   ` [tip:efi/core] efi/x86: Ignore unrealistically large option ROMs tip-bot for Hans de Goede
2018-05-15  9:18     ` Ard Biesheuvel
2018-06-21 15:13       ` Ingo Molnar
2018-05-04  6:00 ` [PATCH 16/17] efi/capsule-loader: Don't output reset log when reset flags are not set Ard Biesheuvel
2018-05-14  7:50   ` [tip:efi/core] " tip-bot for Shunyong Yang
2018-05-04  6:00 ` [PATCH 17/17] efi/libstub/arm64: handle randomized TEXT_OFFSET Ard Biesheuvel
2018-05-14  6:47   ` Ingo Molnar
2018-05-14  6:48     ` Ard Biesheuvel
2018-05-14  7:00       ` Ingo Molnar
2018-05-14  7:01         ` Ard Biesheuvel

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20180504060003.19618-16-ard.biesheuvel@linaro.org \
    --to=ard.biesheuvel@linaro.org \
    --cc=hdegoede@redhat.com \
    --cc=linux-efi@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=mingo@kernel.org \
    --cc=tglx@linutronix.de \
    --subject='Re: [PATCH 15/17] efi/x86: Ignore unrealistically large option roms' \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).