kernel/drivers/firmware/efi/capsule-loader.c, branch linux-6.5.y

efi: capsule-loader: Fix use-after-free in efi_capsule_write

2022-09-07T16:23:56Z

A race condition may occur if the user calls close() on another thread during a write() operation on the device node of the efi capsule. This is a race condition that occurs between the efi_capsule_write() and efi_capsule_flush() functions of efi_capsule_fops, which ultimately results in UAF. So, the page freeing process is modified to be done in efi_capsule_release() instead of efi_capsule_flush(). Cc: # v4.9+ Signed-off-by: Hyunwoo Kim Link: https://lore.kernel.org/all/20220907102920.GA88602@ubuntu/ Signed-off-by: Ard Biesheuvel

efi/capsule-loader: Drop superfluous assignment

2020-02-23T20:58:31Z

In efi_capsule_write() the value 0 assigned to ret is never used. Identified with cppcheck. Signed-off-by: Heinrich Schuchardt Link: https://lore.kernel.org/r/20200223205435.114915-1-xypron.glpk@gmx.de Signed-off-by: Ard Biesheuvel

efi/capsule-loader: Explicitly include linux/io.h for page_to_phys()

2019-12-10T09:15:48Z

Through a labyrinthian sequence of includes, usage of page_to_phys() is dependent on the include of asm/io.h in x86's asm/realmode.h, which is included in x86's asm/acpi.h and thus by linux/acpi.h. Explicitly include linux/io.h to break the dependency on realmode.h so that a future patch can remove the realmode.h include from acpi.h without breaking the build. Signed-off-by: Sean Christopherson Link: https://lkml.kernel.org/r/20191126165417.22423-7-sean.j.christopherson@intel.com Signed-off-by: Ingo Molnar

efi: Replace GPL license boilerplate with SPDX headers

2019-02-04T07:27:25Z

Replace all GPL license blurbs with an equivalent SPDX header (most files are GPLv2, some are GPLv2+). While at it, drop some outdated header changelogs as well. Signed-off-by: Ard Biesheuvel Cc: AKASHI Takahiro Cc: Alexander Graf Cc: Bjorn Andersson Cc: Borislav Petkov Cc: Heinrich Schuchardt Cc: Jeffrey Hugo Cc: Lee Jones Cc: Leif Lindholm Cc: Linus Torvalds Cc: Matt Fleming Cc: Peter Jones Cc: Peter Zijlstra Cc: Sai Praneeth Prakhya Cc: Thomas Gleixner Cc: linux-efi@vger.kernel.org Link: http://lkml.kernel.org/r/20190202094119.13230-7-ard.biesheuvel@linaro.org Signed-off-by: Ingo Molnar

efi/capsule-loader: Don't output reset log when reset flags are not set

2018-05-14T06:57:49Z

When reset flags in capsule header are not set, it means firmware attempts to immediately process or launch the capsule. Moreover, reset is not needed in this case. The current code will output log to indicate reset. This patch adds a branch to avoid reset log output when the flags are not set. [ardb: use braces in multi-line 'if', clarify comment and commit log] Signed-off-by: Shunyong Yang Signed-off-by: Ard Biesheuvel Cc: Joey Zheng Cc: Linus Torvalds Cc: Matt Fleming Cc: Peter Zijlstra Cc: Thomas Gleixner Cc: linux-efi@vger.kernel.org Link: http://lkml.kernel.org/r/20180504060003.19618-17-ard.biesheuvel@linaro.org Signed-off-by: Ingo Molnar

efi/capsule-loader: Fix pr_err() string to end with newline

2018-01-03T13:03:48Z

pr_err() messages should be terminated with a newline to avoid other messages being concatenated onto the end. Signed-off-by: Arvind Yadav Signed-off-by: Matt Fleming Signed-off-by: Ard Biesheuvel Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Stephen Boyd Cc: Thomas Gleixner Cc: Tyler Baicar Cc: Vasyl Gomonovych Cc: linux-efi@vger.kernel.org Link: http://lkml.kernel.org/r/20180102181042.19074-2-ard.biesheuvel@linaro.org Signed-off-by: Ingo Molnar

efi/capsule-loader: Reinstate virtual capsule mapping

2018-01-03T12:54:31Z

Commit: 82c3768b8d68 ("efi/capsule-loader: Use a cached copy of the capsule header") ... refactored the capsule loading code that maps the capsule header, to avoid having to map it several times. However, as it turns out, the vmap() call we ended up removing did not just map the header, but the entire capsule image, and dropping this virtual mapping breaks capsules that are processed by the firmware immediately (i.e., without a reboot). Unfortunately, that change was part of a larger refactor that allowed a quirk to be implemented for Quark, which has a non-standard memory layout for capsules, and we have slightly painted ourselves into a corner by allowing quirk code to mangle the capsule header and memory layout. So we need to fix this without breaking Quark. Fortunately, Quark does not appear to care about the virtual mapping, and so we can simply do a partial revert of commit: 2a457fb31df6 ("efi/capsule-loader: Use page addresses rather than struct page pointers") ... and create a vmap() mapping of the entire capsule (including header) based on the reinstated struct page array, unless running on Quark, in which case we pass the capsule header copy as before. Reported-by: Ge Song Tested-by: Bryan O'Donoghue Tested-by: Ge Song Signed-off-by: Ard Biesheuvel Cc: Cc: Dave Young Cc: Linus Torvalds Cc: Matt Fleming Cc: Peter Zijlstra Cc: Thomas Gleixner Cc: linux-efi@vger.kernel.org Fixes: 82c3768b8d68 ("efi/capsule-loader: Use a cached copy of the capsule header") Link: http://lkml.kernel.org/r/20180102172110.17018-3-ard.biesheuvel@linaro.org Signed-off-by: Ingo Molnar

efi/capsule-loader: Use page addresses rather than struct page pointers

2017-06-05T15:50:41Z

To give some leeway to code that handles non-standard capsule headers, let's keep an array of page addresses rather than struct page pointers. This gives special implementations of efi_capsule_setup_info() the opportunity to mangle the payload a bit before it is presented to the firmware, without putting any knowledge of the nature of such quirks into the generic code. Tested-by: Bryan O'Donoghue Signed-off-by: Ard Biesheuvel Cc: Linus Torvalds Cc: Matt Fleming Cc: Peter Zijlstra Cc: Thomas Gleixner Cc: linux-efi@vger.kernel.org Link: http://lkml.kernel.org/r/20170602135207.21708-10-ard.biesheuvel@linaro.org Signed-off-by: Ingo Molnar

efi/capsule-loader: Redirect calls to efi_capsule_setup_info() via weak alias

2017-06-05T15:50:41Z

To allow platform specific code to hook into the capsule loading routines, indirect calls to efi_capsule_setup_info() via a weak alias of __efi_capsule_setup_info(), allowing platforms to redefine the former but still use the latter. Tested-by: Bryan O'Donoghue Signed-off-by: Ard Biesheuvel Cc: Linus Torvalds Cc: Matt Fleming Cc: Peter Zijlstra Cc: Thomas Gleixner Cc: linux-efi@vger.kernel.org Link: http://lkml.kernel.org/r/20170602135207.21708-9-ard.biesheuvel@linaro.org Signed-off-by: Ingo Molnar

efi/capsule: Remove NULL test on kmap()

2017-06-05T15:50:40Z

kmap() can't fail. Signed-off-by: Fabian Frederick Signed-off-by: Matt Fleming Signed-off-by: Ard Biesheuvel Cc: Kweh Hock Leong Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Thomas Gleixner Cc: linux-efi@vger.kernel.org Link: http://lkml.kernel.org/r/20170602135207.21708-8-ard.biesheuvel@linaro.org Signed-off-by: Ingo Molnar