OpenE2K
/
linux
6
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

efi/capsule: Move 'capsule' to the stack in efi_capsule_supported() 

Dan Carpenter reports that passing the address of the pointer to the
kmalloc()'d memory for 'capsule' is dangerous:

 "drivers/firmware/efi/capsule.c:109 efi_capsule_supported()
  warn: did you mean to pass the address of 'capsule'

   108
   109          status = efi.query_capsule_caps(&capsule, 1, &max_size, reset);
                                                ^^^^^^^^
  If we modify capsule inside this function call then at the end of the
  function we aren't freeing the original pointer that we allocated."

Ard Biesheuvel noted that we don't even need to call kmalloc() since the
object we allocate isn't very big and doesn't need to persist after the
function returns.

Place 'capsule' on the stack instead.

Suggested-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Matt Fleming <matt@codeblueprint.co.uk>
Acked-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Cc: Andy Lutomirski <luto@amacapital.net>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Brian Gerst <brgerst@gmail.com>
Cc: Bryan O'Donoghue <pure.logic@nexus-software.ie>
Cc: Denys Vlasenko <dvlasenk@redhat.com>
Cc: H. Peter Anvin <hpa@zytor.com>
Cc: Kweh Hock Leong <hock.leong.kweh@intel.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: joeyli <jlee@suse.com>
Cc: linux-efi@vger.kernel.org
Link: http://lkml.kernel.org/r/1462570771-13324-4-git-send-email-matt@codeblueprint.co.uk
Signed-off-by: Ingo Molnar <mingo@kernel.org>
This commit is contained in:
Matt Fleming 2016-05-06 22:39:29 +01:00 committed by Ingo Molnar
parent 2e121d711a
commit fb7a84cac0
1 changed files with 11 additions and 18 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

29
drivers/firmware/efi/capsule.c
View File

@ -86,33 +86,26 @@ bool efi_capsule_pending(int *reset_type)
*/
int efi_capsule_supported(efi_guid_t guid, u32 flags, size_t size, int *reset)
{
efi_capsule_header_t *capsule;
efi_capsule_header_t capsule;
efi_capsule_header_t *cap_list[] = { &capsule };
efi_status_t status;
u64 max_size;
int rv = 0;
if (flags & ~EFI_CAPSULE_SUPPORTED_FLAG_MASK)
return -EINVAL;
capsule = kmalloc(sizeof(*capsule), GFP_KERNEL);
if (!capsule)
return -ENOMEM;
capsule.headersize = capsule.imagesize = sizeof(capsule);
memcpy(&capsule.guid, &guid, sizeof(efi_guid_t));
capsule.flags = flags;
capsule->headersize = capsule->imagesize = sizeof(*capsule);
memcpy(&capsule->guid, &guid, sizeof(efi_guid_t));
capsule->flags = flags;
status = efi.query_capsule_caps(&capsule, 1, &max_size, reset);
if (status != EFI_SUCCESS) {
rv = efi_status_to_err(status);
goto out;
}
status = efi.query_capsule_caps(cap_list, 1, &max_size, reset);
if (status != EFI_SUCCESS)
return efi_status_to_err(status);
if (size > max_size)
rv = -ENOSPC;
out:
kfree(capsule);
return rv;
return -ENOSPC;
return 0;
}
EXPORT_SYMBOL_GPL(efi_capsule_supported);