| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <YE5dJ6U3nPWsXY4D@linux.ibm.com>
Date: Sun, 14 Mar 2021 20:59:51 +0200
From: Mike Rapoport <rppt@...ux.ibm.com>
To: "Rafael J. Wysocki" <rafael@...nel.org>
Cc: David Hildenbrand <david@...hat.com>,
George Kennedy <george.kennedy@...cle.com>,
Robert Moore <robert.moore@...el.com>,
Erik Kaneda <erik.kaneda@...el.com>,
Rafael Wysocki <rafael.j.wysocki@...el.com>,
Len Brown <lenb@...nel.org>,
ACPI Devel Maling List <linux-acpi@...r.kernel.org>,
"open list:ACPI COMPONENT ARCHITECTURE (ACPICA)" <devel@...ica.org>,
Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
Konrad Rzeszutek Wilk <konrad.wilk@...cle.com>,
Dan Carpenter <dan.carpenter@...cle.com>,
Dhaval Giani <dhaval.giani@...cle.com>,
Andrew Morton <akpm@...ux-foundation.org>,
Vlastimil Babka <vbabka@...e.cz>,
Oscar Salvador <osalvador@...e.de>,
Wei Yang <richard.weiyang@...ux.alibaba.com>,
Pankaj Gupta <pankaj.gupta.linux@...il.com>,
Michal Hocko <mhocko@...e.com>
Subject: Re: [PATCH 1/1] ACPI: fix acpi table use after free
On Thu, Mar 11, 2021 at 04:36:31PM +0100, Rafael J. Wysocki wrote:
> On Wed, Mar 10, 2021 at 8:47 PM David Hildenbrand <david@...hat.com> wrote:
> > >
> > > There is some care that should be taken to make sure we get the order
> > > right, but I don't see a fundamental issue here.
>
> Me neither.
>
> > > If I understand correctly, Rafael's concern is about changing the parts of
> > > ACPICA that should be OS agnostic, so I think we just need another place to
> > > call memblock_reserve() rather than acpi_tb_install_table_with_override().
>
> Something like this.
>
> There is also the problem that memblock_reserve() needs to be called
> for all of the tables early enough, which will require some reordering
> of the early init code.
>
> > > Since the reservation should be done early in x86::setup_arch() (and
> > > probably in arm64::setup_arch()) we might just have a function that parses
> > > table headers and reserves them, similarly to how we parse the tables
> > > during KASLR setup.
>
> Right.
I've looked at it a bit more and we do something like the patch below that
nearly duplicates acpi_tb_parse_root_table() which is not very nice.
Besides, reserving ACPI tables early and then calling acpi_table_init()
(and acpi_tb_parse_root_table() again would mean doing the dance with
early_memremap() twice for no good reason.
I believe the most effective way to deal with this would be to have a
function that does parsing, reservation and installs the tables supplied by
the firmware which can be called really early and then another function
that overrides tables if needed a some later point.
--------------------------------------------------------------
diff --git a/arch/x86/kernel/setup.c b/arch/x86/kernel/setup.c
index d883176ef2ce..48bcb1c355ad 100644
--- a/arch/x86/kernel/setup.c
+++ b/arch/x86/kernel/setup.c
@@ -910,6 +910,8 @@ void __init setup_arch(char **cmdline_p)
parse_early_param();
+ acpi_reserve_tables();
+
if (efi_enabled(EFI_BOOT))
efi_memblock_x86_reserve_range();
#ifdef CONFIG_MEMORY_HOTPLUG
diff --git a/drivers/acpi/acpica/actables.h b/drivers/acpi/acpica/actables.h
index e2d0046799a2..6cb5bcf3fb49 100644
--- a/drivers/acpi/acpica/actables.h
+++ b/drivers/acpi/acpica/actables.h
@@ -133,6 +133,9 @@ void
acpi_tb_install_table_with_override(struct acpi_table_desc *new_table_desc,
u8 override, u32 *table_index);
+acpi_physical_address
+acpi_tb_get_root_table_entry(u8 *table_entry, u32 table_entry_size);
+
acpi_status acpi_tb_parse_root_table(acpi_physical_address rsdp_address);
acpi_status
diff --git a/drivers/acpi/acpica/tbutils.c b/drivers/acpi/acpica/tbutils.c
index 4b9b329a5a92..2ad3c08915d4 100644
--- a/drivers/acpi/acpica/tbutils.c
+++ b/drivers/acpi/acpica/tbutils.c
@@ -14,10 +14,6 @@
#define _COMPONENT ACPI_TABLES
ACPI_MODULE_NAME("tbutils")
-/* Local prototypes */
-static acpi_physical_address
-acpi_tb_get_root_table_entry(u8 *table_entry, u32 table_entry_size);
-
#if (!ACPI_REDUCED_HARDWARE)
/*******************************************************************************
*
@@ -162,7 +158,7 @@ struct acpi_table_header *acpi_tb_copy_dsdt(u32 table_index)
*
******************************************************************************/
-static acpi_physical_address
+acpi_physical_address
acpi_tb_get_root_table_entry(u8 *table_entry, u32 table_entry_size)
{
u64 address64;
diff --git a/drivers/acpi/tables.c b/drivers/acpi/tables.c
index e48690a006a4..e4b721bada04 100644
--- a/drivers/acpi/tables.c
+++ b/drivers/acpi/tables.c
@@ -23,6 +23,9 @@
#include <linux/security.h>
#include "internal.h"
+#include "acpica/aclocal.h"
+#include "acpica/actables.h"
+
#ifdef CONFIG_ACPI_CUSTOM_DSDT
#include CONFIG_ACPI_CUSTOM_DSDT_FILE
#endif
@@ -809,6 +812,107 @@ int __init acpi_table_init(void)
return 0;
}
+void __init acpi_reserve_tables(void)
+{
+ u32 i, table_count, table_entry_size, length;
+ acpi_physical_address rsdp_address, address;
+ struct acpi_table_header *table, *hdr;
+ struct acpi_table_rsdp *rsdp;
+ u8 *table_entry;
+
+ rsdp_address = acpi_os_get_root_pointer();
+ if (!rsdp_address) {
+ pr_debug("%s: no rsdp_address\n", __func__);
+ return;
+ }
+
+ /* Map the entire RSDP and extract the address of the RSDT or XSDT */
+ rsdp = acpi_os_map_memory(rsdp_address, sizeof(struct acpi_table_rsdp));
+ if (!rsdp) {
+ pr_debug("%s: can't map rsdp\n", __func__);
+ return;
+ }
+
+ memblock_reserve(rsdp_address, sizeof(struct acpi_table_rsdp));
+
+ /* Use XSDT if present and not overridden. Otherwise, use RSDT */
+ if ((rsdp->revision > 1) &&
+ rsdp->xsdt_physical_address && !acpi_gbl_do_not_use_xsdt) {
+ address = (acpi_physical_address)rsdp->xsdt_physical_address;
+ table_entry_size = ACPI_XSDT_ENTRY_SIZE;
+ } else {
+ address = (acpi_physical_address)rsdp->rsdt_physical_address;
+ table_entry_size = ACPI_RSDT_ENTRY_SIZE;
+ }
+
+ /*
+ * It is not possible to map more than one entry in some environments,
+ * so unmap the RSDP here before mapping other tables
+ */
+ acpi_os_unmap_memory(rsdp, sizeof(struct acpi_table_rsdp));
+
+ /* Map the RSDT/XSDT table header to get the full table length */
+
+ table = acpi_os_map_memory(address, sizeof(struct acpi_table_header));
+ if (!table) {
+ pr_debug("%s: can't map [RX]SDT header\n", __func__);
+ return;
+ }
+
+ /*
+ * Validate length of the table, and map entire table.
+ * Minimum length table must contain at least one entry.
+ */
+ length = table->length;
+ acpi_os_unmap_memory(table, sizeof(struct acpi_table_header));
+
+ if (length < (sizeof(struct acpi_table_header) + table_entry_size)) {
+ pr_debug("Invalid table length 0x%X in RSDT/XSDT", length);
+ return;
+ }
+
+ memblock_reserve(address, length);
+
+ table = acpi_os_map_memory(address, length);
+ if (!table) {
+ pr_debug("%s: can't map [RX]SDT table\n", __func__);
+ return;
+ }
+
+ /* Get the number of entries and pointer to first entry */
+ table_count = (u32)((table->length - sizeof(struct acpi_table_header)) /
+ table_entry_size);
+ table_entry = ACPI_ADD_PTR(u8, table, sizeof(struct acpi_table_header));
+
+ /* reserve tables pointed from the RSDT/XSDT */
+ for (i = 0; i < table_count; i++, table_entry += table_entry_size) {
+
+ /* Get the table physical address (32-bit for RSDT, 64-bit for XSDT) */
+
+ address =
+ acpi_tb_get_root_table_entry(table_entry, table_entry_size);
+
+ /* Skip NULL entries in RSDT/XSDT */
+
+ if (!address)
+ continue;
+
+ hdr = acpi_os_map_memory(address, sizeof(struct acpi_table_header));
+ if (!hdr) {
+ pr_debug("%s: can't map %d header\n", __func__, i);
+ continue;
+ }
+
+ memblock_reserve(address, hdr->length);
+
+ /* FIXME: parse FADT and reserve embedded there tables */
+
+ acpi_os_unmap_memory(hdr, sizeof(struct acpi_table_header));
+ }
+
+ acpi_os_unmap_memory(table, length);
+}
+
static int __init acpi_parse_apic_instance(char *str)
{
if (!str)
diff --git a/include/linux/acpi.h b/include/linux/acpi.h
index 9f432411e988..d8688e4b6726 100644
--- a/include/linux/acpi.h
+++ b/include/linux/acpi.h
@@ -226,6 +226,8 @@ void acpi_boot_table_init (void);
int acpi_mps_check (void);
int acpi_numa_init (void);
+void acpi_reserve_tables(void);
+
int acpi_table_init (void);
int acpi_table_parse(char *id, acpi_tbl_table_handler handler);
int __init acpi_table_parse_entries(char *id, unsigned long table_size,
--
Sincerely yours,
Mike.
Powered by blists - more mailing lists