• Dan Williams's avatar
    efi: Fix handling of multiple efi_fake_mem= entries · 484a418d
    Dan Williams authored
    Dave noticed that when specifying multiple efi_fake_mem= entries only
    the last entry was successfully being reflected in the efi memory map.
    This is due to the fact that the efi_memmap_insert() is being called
    multiple times, but on successive invocations the insertion should be
    applied to the last new memmap rather than the original map at
    efi_fake_memmap() entry.
    
    Rework efi_fake_memmap() to install the new memory map after each
    efi_fake_mem= entry is parsed.
    
    This also fixes an issue in efi_fake_memmap() that caused it to litter
    emtpy entries into the end of the efi memory map. An empty entry causes
    efi_memmap_insert() to attempt more memmap splits / copies than
    efi_memmap_split_count() accounted for when sizing the new map. When
    that happens efi_memmap_insert() may overrun its allocation, and if you
    are lucky will spill over to an unmapped page leading to crash
    signature like the following rather than silent corruption:
    
        BUG: unable to handle page fault for address: ffffffffff281000
        [..]
        RIP: 0010:efi_memmap_insert+0x11d/0x191
        [..]
        Call Trace:
         ? bgrt_init+0xbe/0xbe
         ? efi_arch_mem_reserve+0x1cb/0x228
         ? acpi_parse_bgrt+0xa/0xd
         ? acpi_table_parse+0x86/0xb8
         ? acpi_boot_init+0x494/0x4e3
         ? acpi_parse_x2apic+0x87/0x87
         ? setup_acpi_sci+0xa2/0xa2
         ? setup_arch+0x8db/0x9e1
         ? start_kernel+0x6a/0x547
         ? secondary_startup_64+0xb6/0xc0
    
    Commit af164898 "x86/efi: Update e820 with reserved EFI boot
    services data to fix kexec breakage" introduced more occurrences where
    efi_memmap_insert() is invoked after an efi_fake_mem= configuration has
    been parsed. Previously the side effects of vestigial empty entries were
    benign, but with commit af164898 that follow-on efi_memmap_insert()
    invocation triggers efi_memmap_insert() overruns.
    Reported-by: default avatarDave Young <dyoung@redhat.com>
    Signed-off-by: default avatarDan Williams <dan.j.williams@intel.com>
    Signed-off-by: default avatarArd Biesheuvel <ardb@kernel.org>
    Signed-off-by: default avatarIngo Molnar <mingo@kernel.org>
    Link: https://lore.kernel.org/r/20191231014630.GA24942@dhcp-128-65.nay.redhat.com
    Link: https://lore.kernel.org/r/20200113172245.27925-14-ardb@kernel.org
    484a418d
fake_mem.c 2.77 KB