Commit 8b981af0 authored by Lv Yunlong's avatar Lv Yunlong Committed by Zheng Zengkai
Browse files

firmware/efi: Fix a use after bug in efi_mem_reserve_persistent 



stable inclusion
from stable-5.10.26
commit 80b2787789afef0a98e64eb9a1a9203f4a83ff99
bugzilla: 51363

--------------------------------

commit 9ceee7d0 upstream.

In the for loop in efi_mem_reserve_persistent(), prsv = rsv->next
use the unmapped rsv. Use the unmapped pages will cause segment
fault.

Fixes: 18df7577 ("efi/memreserve: deal with memreserve entries in unmapped memory")
Signed-off-by: default avatarLv Yunlong <lyl2019@mail.ustc.edu.cn>
Signed-off-by: default avatarArd Biesheuvel <ardb@kernel.org>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: default avatarChen Jun <chenjun102@huawei.com>
Acked-by: default avatar&nbsp; Weilong Chen <chenweilong@huawei.com>
Signed-off-by: default avatarZheng Zengkai <zhengzengkai@huawei.com>
parent 558b335e

drivers/firmware/efi/efi.c

+2 −1
Original line number Diff line number Diff line
@@ -927,7 +927,7 @@ int __ref efi_mem_reserve_persistent(phys_addr_t addr, u64 size) 
	}



	/* first try to find a slot in an existing linked list entry */

	for (prsv = efi_memreserve_root->next; prsv; prsv = rsv->next) {

	for (prsv = efi_memreserve_root->next; prsv; ) {

		rsv = memremap(prsv, sizeof(*rsv), MEMREMAP_WB);

		index = atomic_fetch_add_unless(&rsv->count, 1, rsv->size);

		if (index < rsv->size) {
@@ -937,6 +937,7 @@ int __ref efi_mem_reserve_persistent(phys_addr_t addr, u64 size) 
			memunmap(rsv);

			return efi_mem_reserve_iomem(addr, size);

		}

		prsv = rsv->next;

		memunmap(rsv);

	}