linux-stable.git/drivers/firmware/efi, branch linux-3.12.y

efi: Fix out-of-bounds read in variable_matches()

2016-05-02T17:54:56+00:00

commit 630ba0cc7a6dbafbdee43795617c872b35cde1b4 upstream.

The variable_matches() function can currently read "var_name[len]", for
example when:

 - var_name[0] == 'a',
 - len == 1
 - match_name points to the NUL-terminated string "ab".

This function is supposed to accept "var_name" inputs that are not
NUL-terminated (hence the "len" parameter"). Document the function, and
access "var_name[*match]" only if "*match" is smaller than "len".

Reported-by: Chris Wilson 
Signed-off-by: Laszlo Ersek 
Cc: Peter Jones 
Cc: Matthew Garrett 
Cc: Jason Andryuk 
Cc: Jani Nikula 
Link: http://thread.gmane.org/gmane.comp.freedesktop.xorg.drivers.intel/86906
Signed-off-by: Matt Fleming 
Signed-off-by: Jiri Slaby

efi: Add pstore variables to the deletion whitelist

2016-03-14T22:10:35+00:00

commit e246eb568bc4cbbdd8a30a3c11151ff9b7ca7312 upstream.

Laszlo explains why this is a good idea,

 'This is because the pstore filesystem can be backed by UEFI variables,
  and (for example) a crash might dump the last kilobytes of the dmesg
  into a number of pstore entries, each entry backed by a separate UEFI
  variable in the above GUID namespace, and with a variable name
  according to the above pattern.

  Please see "drivers/firmware/efi/efi-pstore.c".

  While this patch series will not prevent the user from deleting those
  UEFI variables via the pstore filesystem (i.e., deleting a pstore fs
  entry will continue to delete the backing UEFI variable), I think it
  would be nice to preserve the possibility for the sysadmin to delete
  Linux-created UEFI variables that carry portions of the crash log,
  *without* having to mount the pstore filesystem.'

There's also no chance of causing machines to become bricked by
deleting these variables, which is the whole purpose of excluding
things from the whitelist.

Use the LINUX_EFI_CRASH_GUID guid and a wildcard '*' for the match so
that we don't have to update the string in the future if new variable
name formats are created for crash dump variables.

Reported-by: Laszlo Ersek 
Acked-by: Peter Jones 
Tested-by: Peter Jones 
Cc: Matthew Garrett 
Cc: "Lee, Chun-Yi" 
Signed-off-by: Matt Fleming 
Signed-off-by: Jiri Slaby

efi: Make efivarfs entries immutable by default

2016-03-14T22:10:35+00:00

commit ed8b0de5a33d2a2557dce7f9429dca8cb5bc5879 upstream.

"rm -rf" is bricking some peoples' laptops because of variables being
used to store non-reinitializable firmware driver data that's required
to POST the hardware.

These are 100% bugs, and they need to be fixed, but in the mean time it
shouldn't be easy to *accidentally* brick machines.

We have to have delete working, and picking which variables do and don't
work for deletion is quite intractable, so instead make everything
immutable by default (except for a whitelist), and make tools that
aren't quite so broad-spectrum unset the immutable flag.

Signed-off-by: Peter Jones 
Tested-by: Lee, Chun-Yi 
Acked-by: Matthew Garrett 
Signed-off-by: Matt Fleming 
Signed-off-by: Jiri Slaby

efi: Make our variable validation list include the guid

2016-03-14T22:10:34+00:00

commit 8282f5d9c17fe15a9e658c06e3f343efae1a2a2f upstream.

All the variables in this list so far are defined to be in the global
namespace in the UEFI spec, so this just further ensures we're
validating the variables we think we are.

Including the guid for entries will become more important in future
patches when we decide whether or not to allow deletion of variables
based on presence in this list.

Signed-off-by: Peter Jones 
Tested-by: Lee, Chun-Yi 
Acked-by: Matthew Garrett 
Signed-off-by: Matt Fleming 
Signed-off-by: Jiri Slaby

efi: Do variable name validation tests in utf8

2016-03-14T22:10:33+00:00

commit 3dcb1f55dfc7631695e69df4a0d589ce5274bd07 upstream.

Actually translate from ucs2 to utf8 before doing the test, and then
test against our other utf8 data, instead of fudging it.

Signed-off-by: Peter Jones 
Acked-by: Matthew Garrett 
Tested-by: Lee, Chun-Yi 
Signed-off-by: Matt Fleming 
Signed-off-by: Jiri Slaby

efi: Use ucs2_as_utf8 in efivarfs instead of open coding a bad version

2016-03-14T22:10:33+00:00

commit e0d64e6a880e64545ad7d55786aa84ab76bac475 upstream.

Translate EFI's UCS-2 variable names to UTF-8 instead of just assuming
all variable names fit in ASCII.

Signed-off-by: Peter Jones 
Acked-by: Matthew Garrett 
Tested-by: Lee, Chun-Yi 
Signed-off-by: Matt Fleming 
Signed-off-by: Jiri Slaby

firmware: Do not use WARN_ON(!spin_is_locked())

2014-09-17T14:55:02+00:00

commit aee530cfecf4f3ec83b78406bac618cec35853f8 upstream.

spin_is_locked() always returns false for uniprocessor configurations
in several architectures, so do not use WARN_ON with it.
Use lockdep_assert_held() instead to also reduce overhead in
non-debug kernels.

Signed-off-by: Guenter Roeck 
Signed-off-by: Matt Fleming 
Signed-off-by: Jiri Slaby

efi-pstore: Fix an overflow on 32-bit builds

2014-07-02T10:06:43+00:00

commit 783ee43118dc773bc8b0342c5b230e017d5a04d0 upstream.

In generic_id the long int timestamp is multiplied by 100000 and needs
an explicit cast to u64.

Without that the id in the resulting pstore filename is wrong and
userspace may have problems parsing it, but more importantly files in
pstore can never be deleted and may fill the EFI flash (brick device?).
This happens because when generic pstore code wants to delete a file,
it passes the id to the EFI backend which reinterpretes it and a wrong
variable name is attempted to be deleted.  There's no error message but
after remounting pstore, deleted files would reappear.

Signed-off-by: Andrew Zaborowski 
Acked-by: David Rientjes 
Signed-off-by: Matt Fleming 
Signed-off-by: Jiri Slaby

efi-pstore: Make efi-pstore return a unique id

2013-12-12T06:37:53+00:00

commit fdeadb43fdf1e7d5698c027b555c389174548e5a upstream.

Pstore fs expects that backends provide a unique id which could avoid
pstore making entries as duplication or denominating entries the same
name. So I combine the timestamp, part and count into id.

Signed-off-by: Madper Xie 
Cc: Seiji Aguchi 
Signed-off-by: Matt Fleming 
Signed-off-by: Greg Kroah-Hartman

efivars, efi-pstore: Hold off deletion of sysfs entry until the scan is completed

2013-12-12T06:37:53+00:00

commit e0d59733f6b1796b8d6692642c87d7dd862c3e3a upstream.

Currently, when mounting pstore file system, a read callback of
efi_pstore driver runs mutiple times as below.

- In the first read callback, scan efivar_sysfs_list from head and pass
  a kmsg buffer of a entry to an upper pstore layer.
- In the second read callback, rescan efivar_sysfs_list from the entry
  and pass another kmsg buffer to it.
- Repeat the scan and pass until the end of efivar_sysfs_list.

In this process, an entry is read across the multiple read function
calls. To avoid race between the read and erasion, the whole process
above is protected by a spinlock, holding in open() and releasing in
close().

At the same time, kmemdup() is called to pass the buffer to pstore
filesystem during it. And then, it causes a following lockdep warning.

To make the dynamic memory allocation runnable without taking spinlock,
holding off a deletion of sysfs entry if it happens while scanning it
via efi_pstore, and deleting it after the scan is completed.

To implement it, this patch introduces two flags, scanning and deleting,
to efivar_entry.

On the code basis, it seems that all the scanning and deleting logic is
not needed because __efivars->lock are not dropped when reading from the
EFI variable store.

But, the scanning and deleting logic is still needed because an
efi-pstore and a pstore filesystem works as follows.

In case an entry(A) is found, the pointer is saved to psi->data.  And
efi_pstore_read() passes the entry(A) to a pstore filesystem by
releasing  __efivars->lock.

And then, the pstore filesystem calls efi_pstore_read() again and the
same entry(A), which is saved to psi->data, is used for resuming to scan
a sysfs-list.

So, to protect the entry(A), the logic is needed.

[    1.143710] ------------[ cut here ]------------
[    1.144058] WARNING: CPU: 1 PID: 1 at kernel/lockdep.c:2740 lockdep_trace_alloc+0x104/0x110()
[    1.144058] DEBUG_LOCKS_WARN_ON(irqs_disabled_flags(flags))
[    1.144058] Modules linked in:
[    1.144058] CPU: 1 PID: 1 Comm: systemd Not tainted 3.11.0-rc5 #2
[    1.144058]  0000000000000009 ffff8800797e9ae0 ffffffff816614a5 ffff8800797e9b28
[    1.144058]  ffff8800797e9b18 ffffffff8105510d 0000000000000080 0000000000000046
[    1.144058]  00000000000000d0 00000000000003af ffffffff81ccd0c0 ffff8800797e9b78
[    1.144058] Call Trace:
[    1.144058]  [] dump_stack+0x54/0x74
[    1.144058]  [] warn_slowpath_common+0x7d/0xa0
[    1.144058]  [] warn_slowpath_fmt+0x4c/0x50
[    1.144058]  [] ? vsscanf+0x57f/0x7b0
[    1.144058]  [] lockdep_trace_alloc+0x104/0x110
[    1.144058]  [] __kmalloc_track_caller+0x50/0x280
[    1.144058]  [] ? efi_pstore_read_func.part.1+0x12b/0x170
[    1.144058]  [] kmemdup+0x20/0x50
[    1.144058]  [] efi_pstore_read_func.part.1+0x12b/0x170
[    1.144058]  [] ? efi_pstore_read_func.part.1+0x170/0x170
[    1.144058]  [] efi_pstore_read_func+0xb4/0xe0
[    1.144058]  [] __efivar_entry_iter+0xfb/0x120
[    1.144058]  [] efi_pstore_read+0x3f/0x50
[    1.144058]  [] pstore_get_records+0x9a/0x150
[    1.158207]  [] ? selinux_d_instantiate+0x1c/0x20
[    1.158207]  [] ? parse_options+0x80/0x80
[    1.158207]  [] pstore_fill_super+0xa5/0xc0
[    1.158207]  [] mount_single+0xa2/0xd0
[    1.158207]  [] pstore_mount+0x18/0x20
[    1.158207]  [] mount_fs+0x39/0x1b0
[    1.158207]  [] ? __alloc_percpu+0x10/0x20
[    1.158207]  [] vfs_kern_mount+0x63/0xf0
[    1.158207]  [] do_mount+0x23e/0xa20
[    1.158207]  [] ? strndup_user+0x4b/0xf0
[    1.158207]  [] SyS_mount+0x83/0xc0
[    1.158207]  [] system_call_fastpath+0x16/0x1b
[    1.158207] ---[ end trace 61981bc62de9f6f4 ]---

Signed-off-by: Seiji Aguchi 
Tested-by: Madper Xie 
Signed-off-by: Matt Fleming 
Signed-off-by: Greg Kroah-Hartman