Commit f280b987 authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'efi-urgent-for-v6.0-1' of git://git.kernel.org/pub/scm/linux/kernel/git/efi/efi 

Pull EFI fixes from Ard Biesheuvel:
 "A couple of low-priority EFI fixes:

   - prevent the randstruct plugin from re-ordering EFI protocol
     definitions

   - fix a use-after-free in the capsule loader

   - drop unused variable"

* tag 'efi-urgent-for-v6.0-1' of git://git.kernel.org/pub/scm/linux/kernel/git/efi/efi:
  efi: capsule-loader: Fix use-after-free in efi_capsule_write
  efi/x86: libstub: remove unused variable
  efi: libstub: Disable struct randomization
parents 0066f1b0 9cb636b5

drivers/firmware/efi/capsule-loader.c

+7 −24
Original line number Diff line number Diff line
@@ -242,29 +242,6 @@ static ssize_t efi_capsule_write(struct file *file, const char __user *buff, 
	return ret;

}



/**

 * efi_capsule_flush - called by file close or file flush

 * @file: file pointer

 * @id: not used

 *

 *	If a capsule is being partially uploaded then calling this function

 *	will be treated as upload termination and will free those completed

 *	buffer pages and -ECANCELED will be returned.

 **/

static int efi_capsule_flush(struct file *file, fl_owner_t id)

{

	int ret = 0;

	struct capsule_info *cap_info = file->private_data;



	if (cap_info->index > 0) {

		pr_err("capsule upload not complete\n");

		efi_free_all_buff_pages(cap_info);

		ret = -ECANCELED;

	}



	return ret;

}



/**

 * efi_capsule_release - called by file close

 * @inode: not used
@@ -277,6 +254,13 @@ static int efi_capsule_release(struct inode *inode, struct file *file) 
{

	struct capsule_info *cap_info = file->private_data;



	if (cap_info->index > 0 &&

	    (cap_info->header.headersize == 0 ||

	     cap_info->count < cap_info->total_size)) {

		pr_err("capsule upload not complete\n");

		efi_free_all_buff_pages(cap_info);

	}



	kfree(cap_info->pages);

	kfree(cap_info->phys);

	kfree(file->private_data);
@@ -324,7 +308,6 @@ static const struct file_operations efi_capsule_fops = { 
	.owner = THIS_MODULE,

	.open = efi_capsule_open,

	.write = efi_capsule_write,

	.flush = efi_capsule_flush,

	.release = efi_capsule_release,

	.llseek = no_llseek,

};

drivers/firmware/efi/libstub/Makefile

+7 −0
Original line number Diff line number Diff line
@@ -37,6 +37,13 @@ KBUILD_CFLAGS := $(cflags-y) -Os -DDISABLE_BRANCH_PROFILING \ 
				   $(call cc-option,-fno-addrsig) \

				   -D__DISABLE_EXPORTS



#

# struct randomization only makes sense for Linux internal types, which the EFI

# stub code never touches, so let's turn off struct randomization for the stub

# altogether

#

KBUILD_CFLAGS := $(filter-out $(RANDSTRUCT_CFLAGS), $(KBUILD_CFLAGS))



# remove SCS flags from all objects in this directory

KBUILD_CFLAGS := $(filter-out $(CC_FLAGS_SCS), $(KBUILD_CFLAGS))

# disable LTO

drivers/firmware/efi/libstub/x86-stub.c

+0 −1
Original line number Diff line number Diff line
@@ -220,7 +220,6 @@ adjust_memory_range_protection(unsigned long start, unsigned long size) 
	unsigned long end, next;

	unsigned long rounded_start, rounded_end;

	unsigned long unprotect_start, unprotect_size;

	int has_system_memory = 0;



	if (efi_dxe_table == NULL)

		return;