Skip to content
Snippets Groups Projects
  • Dave Young's avatar
    792ef14d
    efi: Fix boot panic because of invalid BGRT image address · 792ef14d
    Dave Young authored
    Maniaxx reported a kernel boot crash in the EFI code, which I emulated
    by using same invalid phys addr in code:
    
      BUG: unable to handle kernel paging request at ffffffffff280001
      IP: efi_bgrt_init+0xfb/0x153
      ...
      Call Trace:
       ? bgrt_init+0xbc/0xbc
       acpi_parse_bgrt+0xe/0x12
       acpi_table_parse+0x89/0xb8
       acpi_boot_init+0x445/0x4e2
       ? acpi_parse_x2apic+0x79/0x79
       ? dmi_ignore_irq0_timer_override+0x33/0x33
       setup_arch+0xb63/0xc82
       ? early_idt_handler_array+0x120/0x120
       start_kernel+0xb7/0x443
       ? early_idt_handler_array+0x120/0x120
       x86_64_start_reservations+0x29/0x2b
       x86_64_start_kernel+0x154/0x177
       secondary_startup_64+0x9f/0x9f
    
    There is also a similar bug filed in bugzilla.kernel.org:
    
      https://bugzilla.kernel.org/show_bug.cgi?id=195633
    
    The crash is caused by this commit:
    
      7b0a9114 efi/x86: Move the EFI BGRT init code to early init code
    
    The root cause is the firmware on those machines provides invalid BGRT
    image addresses.
    
    In a kernel before above commit BGRT initializes late and uses ioremap()
    to map the image address. Ioremap validates the address, if it is not a
    valid physical address ioremap() just fails and returns. However in current
    kernel EFI BGRT initializes early and uses early_memremap() which does not
    validate the image address, and kernel panic happens.
    
    According to ACPI spec the BGRT image address should fall into
    EFI_BOOT_SERVICES_DATA, see the section 5.2.22.4 of below document:
    
      http://www.uefi.org/sites/default/files/resources/ACPI_6_1.pdf
    
    
    
    Fix this issue by validating the image address in efi_bgrt_init(). If the
    image address does not fall into any EFI_BOOT_SERVICES_DATA areas we just
    bail out with a warning message.
    
    Reported-by: default avatarManiaxx <tripleshiftone@gmail.com>
    Signed-off-by: default avatarDave Young <dyoung@redhat.com>
    Signed-off-by: default avatarArd Biesheuvel <ard.biesheuvel@linaro.org>
    Cc: Linus Torvalds <torvalds@linux-foundation.org>
    Cc: Matt Fleming <matt@codeblueprint.co.uk>
    Cc: Peter Zijlstra <peterz@infradead.org>
    Cc: Thomas Gleixner <tglx@linutronix.de>
    Cc: linux-efi@vger.kernel.org
    Fixes: 7b0a9114 ("efi/x86: Move the EFI BGRT init code to early init code")
    Link: http://lkml.kernel.org/r/20170609084558.26766-2-ard.biesheuvel@linaro.org
    
    
    Signed-off-by: default avatarIngo Molnar <mingo@kernel.org>
    792ef14d
    History
    efi: Fix boot panic because of invalid BGRT image address
    Dave Young authored
    Maniaxx reported a kernel boot crash in the EFI code, which I emulated
    by using same invalid phys addr in code:
    
      BUG: unable to handle kernel paging request at ffffffffff280001
      IP: efi_bgrt_init+0xfb/0x153
      ...
      Call Trace:
       ? bgrt_init+0xbc/0xbc
       acpi_parse_bgrt+0xe/0x12
       acpi_table_parse+0x89/0xb8
       acpi_boot_init+0x445/0x4e2
       ? acpi_parse_x2apic+0x79/0x79
       ? dmi_ignore_irq0_timer_override+0x33/0x33
       setup_arch+0xb63/0xc82
       ? early_idt_handler_array+0x120/0x120
       start_kernel+0xb7/0x443
       ? early_idt_handler_array+0x120/0x120
       x86_64_start_reservations+0x29/0x2b
       x86_64_start_kernel+0x154/0x177
       secondary_startup_64+0x9f/0x9f
    
    There is also a similar bug filed in bugzilla.kernel.org:
    
      https://bugzilla.kernel.org/show_bug.cgi?id=195633
    
    The crash is caused by this commit:
    
      7b0a9114 efi/x86: Move the EFI BGRT init code to early init code
    
    The root cause is the firmware on those machines provides invalid BGRT
    image addresses.
    
    In a kernel before above commit BGRT initializes late and uses ioremap()
    to map the image address. Ioremap validates the address, if it is not a
    valid physical address ioremap() just fails and returns. However in current
    kernel EFI BGRT initializes early and uses early_memremap() which does not
    validate the image address, and kernel panic happens.
    
    According to ACPI spec the BGRT image address should fall into
    EFI_BOOT_SERVICES_DATA, see the section 5.2.22.4 of below document:
    
      http://www.uefi.org/sites/default/files/resources/ACPI_6_1.pdf
    
    
    
    Fix this issue by validating the image address in efi_bgrt_init(). If the
    image address does not fall into any EFI_BOOT_SERVICES_DATA areas we just
    bail out with a warning message.
    
    Reported-by: default avatarManiaxx <tripleshiftone@gmail.com>
    Signed-off-by: default avatarDave Young <dyoung@redhat.com>
    Signed-off-by: default avatarArd Biesheuvel <ard.biesheuvel@linaro.org>
    Cc: Linus Torvalds <torvalds@linux-foundation.org>
    Cc: Matt Fleming <matt@codeblueprint.co.uk>
    Cc: Peter Zijlstra <peterz@infradead.org>
    Cc: Thomas Gleixner <tglx@linutronix.de>
    Cc: linux-efi@vger.kernel.org
    Fixes: 7b0a9114 ("efi/x86: Move the EFI BGRT init code to early init code")
    Link: http://lkml.kernel.org/r/20170609084558.26766-2-ard.biesheuvel@linaro.org
    
    
    Signed-off-by: default avatarIngo Molnar <mingo@kernel.org>
efi-bgrt.c 2.56 KiB
/*
 * Copyright 2012 Intel Corporation
 * Author: Josh Triplett <josh@joshtriplett.org>
 *
 * Based on the bgrt driver:
 * Copyright 2012 Red Hat, Inc <mjg@redhat.com>
 * Author: Matthew Garrett
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License version 2 as
 * published by the Free Software Foundation.
 */

#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt

#include <linux/kernel.h>
#include <linux/init.h>
#include <linux/acpi.h>
#include <linux/efi.h>
#include <linux/efi-bgrt.h>

struct acpi_table_bgrt bgrt_tab;
size_t __initdata bgrt_image_size;

struct bmp_header {
	u16 id;
	u32 size;
} __packed;

static bool efi_bgrt_addr_valid(u64 addr)
{
	efi_memory_desc_t *md;

	for_each_efi_memory_desc(md) {
		u64 size;
		u64 end;

		if (md->type != EFI_BOOT_SERVICES_DATA)
			continue;

		size = md->num_pages << EFI_PAGE_SHIFT;
		end = md->phys_addr + size;
		if (addr >= md->phys_addr && addr < end)
			return true;
	}

	return false;
}

void __init efi_bgrt_init(struct acpi_table_header *table)
{
	void *image;
	struct bmp_header bmp_header;
	struct acpi_table_bgrt *bgrt = &bgrt_tab;

	if (acpi_disabled)
		return;

	if (!efi_enabled(EFI_MEMMAP))
		return;

	if (table->length < sizeof(bgrt_tab)) {
		pr_notice("Ignoring BGRT: invalid length %u (expected %zu)\n",
		       table->length, sizeof(bgrt_tab));
		return;
	}
	*bgrt = *(struct acpi_table_bgrt *)table;
	if (bgrt->version != 1) {
		pr_notice("Ignoring BGRT: invalid version %u (expected 1)\n",
		       bgrt->version);
		goto out;
	}
	if (bgrt->status & 0xfe) {
		pr_notice("Ignoring BGRT: reserved status bits are non-zero %u\n",
		       bgrt->status);
		goto out;
	}
	if (bgrt->image_type != 0) {
		pr_notice("Ignoring BGRT: invalid image type %u (expected 0)\n",
		       bgrt->image_type);
		goto out;
	}
	if (!bgrt->image_address) {
		pr_notice("Ignoring BGRT: null image address\n");
		goto out;
	}

	if (!efi_bgrt_addr_valid(bgrt->image_address)) {
		pr_notice("Ignoring BGRT: invalid image address\n");
		goto out;
	}
	image = early_memremap(bgrt->image_address, sizeof(bmp_header));
	if (!image) {
		pr_notice("Ignoring BGRT: failed to map image header memory\n");
		goto out;
	}

	memcpy(&bmp_header, image, sizeof(bmp_header));
	early_memunmap(image, sizeof(bmp_header));
	if (bmp_header.id != 0x4d42) {
		pr_notice("Ignoring BGRT: Incorrect BMP magic number 0x%x (expected 0x4d42)\n",
			bmp_header.id);
		goto out;
	}
	bgrt_image_size = bmp_header.size;
	efi_mem_reserve(bgrt->image_address, bgrt_image_size);

	return;
out:
	memset(bgrt, 0, sizeof(bgrt_tab));
}