linux-kernel - Re: [GIT PULL] x86 fixes for 3.9

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Fri, 26 Apr 2013 00:43:25 -0700
From:	Michel Lespinasse <walken@...gle.com>
To:	Matt Fleming <matt.fleming@...el.com>
Cc:	"H. Peter Anvin" <hpa@...or.com>,
	Matthew Garrett <matthew.garrett@...ula.com>,
	Linus Torvalds <torvalds@...ux-foundation.org>,
	"H. Peter Anvin" <hpa@...ux.intel.com>,
	Borislav Petkov <bp@...e.de>, Ingo Molnar <mingo@...e.hu>,
	Josh Boyer <jwboyer@...hat.com>,
	Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
	Paul Bolle <pebolle@...cali.nl>,
	Thomas Gleixner <tglx@...utronix.de>
Subject: Re: [GIT PULL] x86 fixes for 3.9

On Fri, Apr 26, 2013 at 12:12 AM, Matt Fleming <matt.fleming@...el.com> wrote:
> On 26/04/13 00:11, Michel Lespinasse wrote:
>> On Thu, Apr 25, 2013 at 3:54 PM, H. Peter Anvin <hpa@...or.com> wrote:
>>> On 04/25/2013 03:53 PM, Michel Lespinasse wrote:
>>>> Well, I don't know if this is related, but commit e971318bbed6 broke
>>>> the google EFI SMI driver with
>>>> BUG: unable to handle kernel NULL pointer dereference at (null)
>>>> IP: [<ffffffff814a7245>] variable_is_present+0x55/0x170
>>>> Call Trace:
>>>> [<ffffffff814a9936>] register_efivars+0x106/0x370
>>>> [<ffffffff818ff430>] ? firmware_map_add_early+0xb1/0xb1
>>>> [<ffffffff818ff6dd>] gsmi_init+0x2ad/0x3da
>>>> [<ffffffff8100020f>] do_one_initcall+0x3f/0x170
>>>> ...
>>>
>>> I don't know either.  Could you test this patch and see if it does anything?
>>
>> Nope, still seeing the crash with this patch applied.
>
> Could you try the following patch against Linus' tree? The bug you've
> found and the changes in the pull request are unrelated.
>
> diff --git a/drivers/firmware/efivars.c b/drivers/firmware/efivars.c
> index 182ce94..2a4f619 100644
> --- a/drivers/firmware/efivars.c
> +++ b/drivers/firmware/efivars.c
> @@ -1635,6 +1635,9 @@ static bool variable_is_present(efi_char16_t *variable_name, efi_guid_t *vendor)
>         unsigned long strsize1, strsize2;
>         bool found = false;
>
> +       if (list_empty(&efivars->list))
> +               return false;
> +
>         strsize1 = ucs2_strsize(variable_name, 1024);
>         list_for_each_entry_safe(entry, n, &efivars->list, list) {
>                 strsize2 = ucs2_strsize(entry->var.VariableName, 1024);

Still seeing the crash.

I went and compared the crash dump with the vmlinux disassembly; the
issue is a NULL pointer dereference in list_for_each_entry_safe().
list_empty() checks that the head node points to itself, but here the
head node has NULL. I think this may be due to gsmi_init() being
called before efivars_init(). Not sure what's the proper fix though.

-- 
Michel "Walken" Lespinasse
A program is never fully debugged until the last user dies.
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/