• Ard Biesheuvel's avatar
    arm64: kernel: restrict /dev/mem read() calls to linear region · 50f48039
    Ard Biesheuvel authored
    
    [ Upstream commit 1151f838 ]
    
    When running lscpu on an AArch64 system that has SMBIOS version 2.0
    tables, it will segfault in the following way:
    
      Unable to handle kernel paging request at virtual address ffff8000bfff0000
      pgd = ffff8000f9615000
      [ffff8000bfff0000] *pgd=0000000000000000
      Internal error: Oops: 96000007 [#1] PREEMPT SMP
      Modules linked in:
      CPU: 0 PID: 1284 Comm: lscpu Not tainted 4.11.0-rc3+ #103
      Hardware name: QEMU QEMU Virtual Machine, BIOS 0.0.0 02/06/2015
      task: ffff8000fa78e800 task.stack: ffff8000f9780000
      PC is at __arch_copy_to_user+0x90/0x220
      LR is at read_mem+0xcc/0x140
    
    This is caused by the fact that lspci issues a read() on /dev/mem at the
    offset where it expects to find the SMBIOS structure array. However, this
    region is classified as EFI_RUNTIME_SERVICE_DATA (as per the UEFI spec),
    and so it is omitted from the linear mapping.
    
    So let's restrict /dev/mem read/write access to those areas that are
    covered by the linear region.
    Reported-by: default avatarAlexander Graf <agraf@suse.de>
    Fixes: 4dffbfc4 ("arm64/efi: mark UEFI reserved regions as MEMBLOCK_NOMAP")
    Signed-off-by: default avatarArd Biesheuvel <ard.biesheuvel@linaro.org>
    Signed-off-by: default avatarWill Deacon <will.deacon@arm.com>
    Signed-off-by: default avatarSasha Levin <alexander.levin@microsoft.com>
    Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
    50f48039
mmap.c 3.88 KB