Commit 56558ea1 authored Apr 23, 2024 by Andrew Bresticker Committed by Yongqiang Liu Apr 23, 2024

efi: runtime: Fix potential overflow of soft-reserved region size

stable inclusion
from stable-v5.10.211
commit 4fff3d735baea104017f2e3c245e27cdc79f2426
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9HJU0


CVE: CVE-2024-26843

--------------------------------

[ Upstream commit de1034b38a346ef6be25fe8792f5d1e0684d5ff4 ]

md_size will have been narrowed if we have >= 4GB worth of pages in a
soft-reserved region.

Signed-off-by: Andrew Bresticker <abrestic@rivosinc.com>
Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Yongqiang Liu <liuyongqiang13@huawei.com>

parent b05f2de3

drivers/firmware/efi/arm-runtime.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -107,7 +107,7 @@ static int __init arm_enable_runtime_services(void)
		efi_memory_desc_t *md;

		for_each_efi_memory_desc(md) {
		int md_size = md->num_pages << EFI_PAGE_SHIFT;
		u64 md_size = md->num_pages << EFI_PAGE_SHIFT;
		struct resource *res;

		if (!(md->attribute & EFI_MEMORY_SP))

drivers/firmware/efi/riscv-runtime.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -85,7 +85,7 @@ static int __init riscv_enable_runtime_services(void)
		efi_memory_desc_t *md;

		for_each_efi_memory_desc(md) {
		int md_size = md->num_pages << EFI_PAGE_SHIFT;
		u64 md_size = md->num_pages << EFI_PAGE_SHIFT;
		struct resource *res;

		if (!(md->attribute & EFI_MEMORY_SP))