diff options
author | Laura Abbott <labbott@fedoraproject.org> | 2017-06-14 08:34:46 -0700 |
---|---|---|
committer | Laura Abbott <labbott@fedoraproject.org> | 2017-06-14 08:38:16 -0700 |
commit | 733823c45862a5c1267732ee7fd3a4279a3caa94 (patch) | |
tree | 984cb8d56784b462285c79031fa09665067183d5 | |
parent | 9243356b87d92e859ba9e296b9e799766b90d000 (diff) | |
download | kernel-733823c45862a5c1267732ee7fd3a4279a3caa94.tar.gz kernel-733823c45862a5c1267732ee7fd3a4279a3caa94.tar.xz kernel-733823c45862a5c1267732ee7fd3a4279a3caa94.zip |
Add fix for EFI BGRT crash (rhbz 1461337)
-rw-r--r-- | 0001-efi-Fix-boot-panic-because-of-invalid-BGRT-image-add.patch | 114 | ||||
-rw-r--r-- | kernel.spec | 6 |
2 files changed, 120 insertions, 0 deletions
diff --git a/0001-efi-Fix-boot-panic-because-of-invalid-BGRT-image-add.patch b/0001-efi-Fix-boot-panic-because-of-invalid-BGRT-image-add.patch new file mode 100644 index 000000000..4a714e36d --- /dev/null +++ b/0001-efi-Fix-boot-panic-because-of-invalid-BGRT-image-add.patch @@ -0,0 +1,114 @@ +From 87c19e8de4f56d803d133c3e38bbd7b069e06df3 Mon Sep 17 00:00:00 2001 +From: Dave Young <dyoung@redhat.com> +Date: Fri, 9 Jun 2017 08:45:58 +0000 +Subject: [PATCH] efi: Fix boot panic because of invalid BGRT image address + +Maniaxx reported a kernel boot crash in the EFI code, which I emulated +by using same invalid phys addr in code: + + BUG: unable to handle kernel paging request at ffffffffff280001 + IP: efi_bgrt_init+0xfb/0x153 + ... + Call Trace: + ? bgrt_init+0xbc/0xbc + acpi_parse_bgrt+0xe/0x12 + acpi_table_parse+0x89/0xb8 + acpi_boot_init+0x445/0x4e2 + ? acpi_parse_x2apic+0x79/0x79 + ? dmi_ignore_irq0_timer_override+0x33/0x33 + setup_arch+0xb63/0xc82 + ? early_idt_handler_array+0x120/0x120 + start_kernel+0xb7/0x443 + ? early_idt_handler_array+0x120/0x120 + x86_64_start_reservations+0x29/0x2b + x86_64_start_kernel+0x154/0x177 + secondary_startup_64+0x9f/0x9f + +There is also a similar bug filed in bugzilla.kernel.org: + + https://bugzilla.kernel.org/show_bug.cgi?id=195633 + +The crash is caused by this commit: + + 7b0a911478c7 efi/x86: Move the EFI BGRT init code to early init code + +The root cause is the firmware on those machines provides invalid BGRT +image addresses. + +In a kernel before above commit BGRT initializes late and uses ioremap() +to map the image address. Ioremap validates the address, if it is not a +valid physical address ioremap() just fails and returns. However in current +kernel EFI BGRT initializes early and uses early_memremap() which does not +validate the image address, and kernel panic happens. + +According to ACPI spec the BGRT image address should fall into +EFI_BOOT_SERVICES_DATA, see the section 5.2.22.4 of below document: + + http://www.uefi.org/sites/default/files/resources/ACPI_6_1.pdf + +Fix this issue by validating the image address in efi_bgrt_init(). If the +image address does not fall into any EFI_BOOT_SERVICES_DATA areas we just +bail out with a warning message. + +Reported-by: Maniaxx <tripleshiftone@gmail.com> +Signed-off-by: Dave Young <dyoung@redhat.com> +Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org> +Cc: Linus Torvalds <torvalds@linux-foundation.org> +Cc: Matt Fleming <matt@codeblueprint.co.uk> +Cc: Peter Zijlstra <peterz@infradead.org> +Cc: Thomas Gleixner <tglx@linutronix.de> +Cc: linux-efi@vger.kernel.org +Fixes: 7b0a911478c7 ("efi/x86: Move the EFI BGRT init code to early init code") +Link: http://lkml.kernel.org/r/20170609084558.26766-2-ard.biesheuvel@linaro.org +Signed-off-by: Ingo Molnar <mingo@kernel.org> +[labbott@redhat.com: Backport to 4.11] +Signed-off-by: Laura Abbott <labbott@redhat.com> +--- + arch/x86/platform/efi/efi-bgrt.c | 24 ++++++++++++++++++++++++ + 1 file changed, 24 insertions(+) + +diff --git a/arch/x86/platform/efi/efi-bgrt.c b/arch/x86/platform/efi/efi-bgrt.c +index 04ca876..08ee795 100644 +--- a/arch/x86/platform/efi/efi-bgrt.c ++++ b/arch/x86/platform/efi/efi-bgrt.c +@@ -27,6 +27,26 @@ struct bmp_header { + u32 size; + } __packed; + ++static bool efi_bgrt_addr_valid(u64 addr) ++{ ++ efi_memory_desc_t *md; ++ ++ for_each_efi_memory_desc(md) { ++ u64 size; ++ u64 end; ++ ++ if (md->type != EFI_BOOT_SERVICES_DATA) ++ continue; ++ ++ size = md->num_pages << EFI_PAGE_SHIFT; ++ end = md->phys_addr + size; ++ if (addr >= md->phys_addr && addr < end) ++ return true; ++ } ++ ++ return false; ++} ++ + void __init efi_bgrt_init(struct acpi_table_header *table) + { + void *image; +@@ -62,6 +82,10 @@ void __init efi_bgrt_init(struct acpi_table_header *table) + goto out; + } + ++ if (!efi_bgrt_addr_valid(bgrt->image_address)) { ++ pr_notice("Ignoring BGRT: invalid image address\n"); ++ goto out; ++ } + image = early_memremap(bgrt->image_address, sizeof(bmp_header)); + if (!image) { + pr_notice("Ignoring BGRT: failed to map image header memory\n"); +-- +2.7.5 + diff --git a/kernel.spec b/kernel.spec index ac2c124e5..f21f3bb90 100644 --- a/kernel.spec +++ b/kernel.spec @@ -635,6 +635,9 @@ Patch679: actual_udpencap_fix.patch Patch680: 0001-platform-x86-thinkpad_acpi-guard-generic-hotkey-case.patch Patch681: 0002-platform-x86-thinkpad_acpi-add-mapping-for-new-hotke.patch +# rhbz 1461337 +Patch682: 0001-efi-Fix-boot-panic-because-of-invalid-BGRT-image-add.patch + # END OF PATCH DEFINITIONS %endif @@ -2199,6 +2202,9 @@ fi # # %changelog +* Wed Jun 14 2017 Laura Abbott <labbott@fedoraproject.org> +- Add fix for EFI BGRT crash (rhbz 1461337) + * Wed Jun 07 2017 Laura Abbott <labbott@fedoraproject.org> - 4.11.4-200 - Linux v4.11.4 |