linux-kernel - Re: [PATCH] efi/x86: Free efi_pgd with free

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAMj1kXEZAOh6A1xcURNN48=f-LL6tFv4FEaTLyMLBTLwgTt4wA@mail.gmail.com>
Date:   Tue, 10 Nov 2020 22:43:59 +0100
From:   Ard Biesheuvel <ardb@...nel.org>
To:     Arvind Sankar <nivedita@...m.mit.edu>
Cc:     linux-efi <linux-efi@...r.kernel.org>,
        Linux Kernel Mailing List <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH] efi/x86: Free efi_pgd with free_pages()

On Tue, 10 Nov 2020 at 17:39, Arvind Sankar <nivedita@...m.mit.edu> wrote:
>
> Commit
>   d9e9a6418065 ("x86/mm/pti: Allocate a separate user PGD")
> changed the PGD allocation to allocate PGD_ALLOCATION_ORDER pages, so in
> the error path it should be freed using free_pages() rather than
> free_page().
>
> Commit
>   06ace26f4e6f ("x86/efi: Free efi_pgd with free_pages()")
> fixed one instance of this, but missed another.
>
> Move the freeing out-of-line to avoid code duplication and fix this bug.
>
> Signed-off-by: Arvind Sankar <nivedita@...m.mit.edu>
> Fixes: d9e9a6418065 ("x86/mm/pti: Allocate a separate user PGD")

Thanks Arvind. I'll queue this as a fix.

> ---
>  arch/x86/platform/efi/efi_64.c | 24 +++++++++++++-----------
>  1 file changed, 13 insertions(+), 11 deletions(-)
>
> diff --git a/arch/x86/platform/efi/efi_64.c b/arch/x86/platform/efi/efi_64.c
> index 8f5759df7776..e1e8d4e3a213 100644
> --- a/arch/x86/platform/efi/efi_64.c
> +++ b/arch/x86/platform/efi/efi_64.c
> @@ -78,28 +78,30 @@ int __init efi_alloc_page_tables(void)
>         gfp_mask = GFP_KERNEL | __GFP_ZERO;
>         efi_pgd = (pgd_t *)__get_free_pages(gfp_mask, PGD_ALLOCATION_ORDER);
>         if (!efi_pgd)
> -               return -ENOMEM;
> +               goto fail;
>
>         pgd = efi_pgd + pgd_index(EFI_VA_END);
>         p4d = p4d_alloc(&init_mm, pgd, EFI_VA_END);
> -       if (!p4d) {
> -               free_page((unsigned long)efi_pgd);
> -               return -ENOMEM;
> -       }
> +       if (!p4d)
> +               goto free_pgd;
>
>         pud = pud_alloc(&init_mm, p4d, EFI_VA_END);
> -       if (!pud) {
> -               if (pgtable_l5_enabled())
> -                       free_page((unsigned long) pgd_page_vaddr(*pgd));
> -               free_pages((unsigned long)efi_pgd, PGD_ALLOCATION_ORDER);
> -               return -ENOMEM;
> -       }
> +       if (!pud)
> +               goto free_p4d;
>
>         efi_mm.pgd = efi_pgd;
>         mm_init_cpumask(&efi_mm);
>         init_new_context(NULL, &efi_mm);
>
>         return 0;
> +
> +free_p4d:
> +       if (pgtable_l5_enabled())
> +               free_page((unsigned long)pgd_page_vaddr(*pgd));
> +free_pgd:
> +       free_pages((unsigned long)efi_pgd, PGD_ALLOCATION_ORDER);
> +fail:
> +       return -ENOMEM;
>  }
>
>  /*
> --
> 2.26.2
>