On Thu, Dec 22, 2016 at 2:23 AM, Nicolai Stange <nicstange@xxxxxxxxx> wrote:
> With commit 4bc9f92e64c8 ("x86/efi-bgrt: Use efi_mem_reserve() to avoid
> copying image data"), efi_bgrt_init() calls into the memblock allocator
> through efi_mem_reserve() => efi_arch_mem_reserve() *after* mm_init()
> has been called.
>
> Indeed, KASAN reports a bad read access later on in
> efi_free_boot_services():
>
> BUG: KASAN: use-after-free in efi_free_boot_services+0xae/0x24c
> at addr ffff88022de12740
> Read of size 4 by task swapper/0/0
> page:ffffea0008b78480 count:0 mapcount:-127
> mapping: (null) index:0x1 flags: 0x5fff8000000000()
> [...]
> Call Trace:
> dump_stack+0x68/0x9f
> kasan_report_error+0x4c8/0x500
> kasan_report+0x58/0x60
> __asan_load4+0x61/0x80
> efi_free_boot_services+0xae/0x24c
> start_kernel+0x527/0x562
> x86_64_start_reservations+0x24/0x26
> x86_64_start_kernel+0x157/0x17a
> start_cpu+0x5/0x14
>
> The instruction at the given address is the first read from the memmap's
> memory, i.e. the read of md->type in efi_free_boot_services().
>
> Note that the writes earlier in efi_arch_mem_reserve() don't splat because
> they're done through early_memremap()ed addresses.
>
> So, after memblock is gone, allocations should be done through the "normal"
> page allocator. Introduce a helper, efi_memmap_alloc() for this. Use
> it from efi_arch_mem_reserve() and from efi_free_boot_services() as well.
>
> Fixes: 4bc9f92e64c8 ("x86/efi-bgrt: Use efi_mem_reserve() to avoid copying image data")
> Signed-off-by: Nicolai Stange <nicstange@xxxxxxxxx>
Tested-by: Dan Williams <dan.j.williams@xxxxxxxxx>
This addresses the v4.9 boot regression I reported:
http://marc.info/?l=linux-kernel&m=148349836923836&w=2
--
To unsubscribe from this list: send the line "unsubscribe linux-efi" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
