Commit a5d647cb authored by Ard Biesheuvel's avatar Ard Biesheuvel Committed by liwei
Browse files

efi/x86: Map the entire EFI vendor string before copying it

mainline inclusion
from mainline-v5.6-rc1
commit ffc2760b
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I8MCB5


CVE: NA

---------------------------

Fix a couple of issues with the way we map and copy the vendor string:
- we map only 2 bytes, which usually works since you get at least a
  page, but if the vendor string happens to cross a page boundary,
  a crash will result
- only call early_memunmap() if early_memremap() succeeded, or we will
  call it with a NULL address which it doesn't like,
- while at it, switch to early_memremap_ro(), and array indexing rather
  than pointer dereferencing to read the CHAR16 characters.

Signed-off-by: default avatarArd Biesheuvel <ardb@kernel.org>
Cc: Andy Lutomirski <luto@kernel.org>
Cc: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Cc: Arvind Sankar <nivedita@alum.mit.edu>
Cc: Matthew Garrett <mjg59@google.com>
Cc: linux-efi@vger.kernel.org
Fixes: 5b83683f ("x86: EFI runtime service support")
Link: https://lkml.kernel.org/r/20200103113953.9571-5-ardb@kernel.org


Signed-off-by: default avatarIngo Molnar <mingo@kernel.org>
Signed-off-by: default avatarliwei <liwei728@huawei.com>
parent 9b8b6ad3
Loading
Loading
Loading
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please to comment