Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1396259

[tip:efi/core] efi/capsule: Move 'capsule' to the stack in efi_capsule_supported()

Show all headers | View raw

Commit-ID:  fb7a84cac03541f4da18dfa25b3f4767d4efc6fc
Gitweb:     http://git.kernel.org/tip/fb7a84cac03541f4da18dfa25b3f4767d4efc6fc
Author:     Matt Fleming <matt@codeblueprint.co.uk>
AuthorDate: Fri, 6 May 2016 22:39:29 +0100
Committer:  Ingo Molnar <mingo@kernel.org>
CommitDate: Sat, 7 May 2016 07:06:13 +0200

efi/capsule: Move 'capsule' to the stack in efi_capsule_supported()

Dan Carpenter reports that passing the address of the pointer to the
kmalloc()'d memory for 'capsule' is dangerous:

 "drivers/firmware/efi/capsule.c:109 efi_capsule_supported()
  warn: did you mean to pass the address of 'capsule'

   108
   109          status = efi.query_capsule_caps(&capsule, 1, &max_size, reset);
                                                ^^^^^^^^
  If we modify capsule inside this function call then at the end of the
  function we aren't freeing the original pointer that we allocated."

Ard Biesheuvel noted that we don't even need to call kmalloc() since the
object we allocate isn't very big and doesn't need to persist after the
function returns.

Place 'capsule' on the stack instead.

Suggested-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Matt Fleming <matt@codeblueprint.co.uk>
Acked-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Cc: Andy Lutomirski <luto@amacapital.net>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Brian Gerst <brgerst@gmail.com>
Cc: Bryan O'Donoghue <pure.logic@nexus-software.ie>
Cc: Denys Vlasenko <dvlasenk@redhat.com>
Cc: H. Peter Anvin <hpa@zytor.com>
Cc: Kweh Hock Leong <hock.leong.kweh@intel.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: joeyli <jlee@suse.com>
Cc: linux-efi@vger.kernel.org
Link: http://lkml.kernel.org/r/1462570771-13324-4-git-send-email-matt@codeblueprint.co.uk
Signed-off-by: Ingo Molnar <mingo@kernel.org>
---
 drivers/firmware/efi/capsule.c | 29 +++++++++++------------------
 1 file changed, 11 insertions(+), 18 deletions(-)

diff --git a/drivers/firmware/efi/capsule.c b/drivers/firmware/efi/capsule.c
index e530540..53b9fd2 100644
--- a/drivers/firmware/efi/capsule.c
+++ b/drivers/firmware/efi/capsule.c
@@ -86,33 +86,26 @@ bool efi_capsule_pending(int *reset_type)
  */
 int efi_capsule_supported(efi_guid_t guid, u32 flags, size_t size, int *reset)
 {
-	efi_capsule_header_t *capsule;
+	efi_capsule_header_t capsule;
+	efi_capsule_header_t *cap_list[] = { &capsule };
 	efi_status_t status;
 	u64 max_size;
-	int rv = 0;
 
 	if (flags & ~EFI_CAPSULE_SUPPORTED_FLAG_MASK)
 		return -EINVAL;
 
-	capsule = kmalloc(sizeof(*capsule), GFP_KERNEL);
-	if (!capsule)
-		return -ENOMEM;
-
-	capsule->headersize = capsule->imagesize = sizeof(*capsule);
-	memcpy(&capsule->guid, &guid, sizeof(efi_guid_t));
-	capsule->flags = flags;
+	capsule.headersize = capsule.imagesize = sizeof(capsule);
+	memcpy(&capsule.guid, &guid, sizeof(efi_guid_t));
+	capsule.flags = flags;
 
-	status = efi.query_capsule_caps(&capsule, 1, &max_size, reset);
-	if (status != EFI_SUCCESS) {
-		rv = efi_status_to_err(status);
-		goto out;
-	}
+	status = efi.query_capsule_caps(cap_list, 1, &max_size, reset);
+	if (status != EFI_SUCCESS)
+		return efi_status_to_err(status);
 
 	if (size > max_size)
-		rv = -ENOSPC;
-out:
-	kfree(capsule);
-	return rv;
+		return -ENOSPC;
+
+	return 0;
 }
 EXPORT_SYMBOL_GPL(efi_capsule_supported);
 

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[GIT PULL 0/5] EFI changes for v4.7 Matt Fleming <matt@codeblueprint.co.uk> - 2016-05-06 23:40 +0200
  [PATCH 1/5] efi/capsule: Make efi_capsule_pending() lockless Matt Fleming <matt@codeblueprint.co.uk> - 2016-05-06 23:40 +0200
    [tip:efi/core] efi/capsule: Make efi_capsule_pending() lockless tip-bot for Matt Fleming <tipbot@zytor.com> - 2016-05-07 08:40 +0200
  [PATCH 5/5] efivarfs: Make efivarfs_file_ioctl static Matt Fleming <matt@codeblueprint.co.uk> - 2016-05-06 23:50 +0200
    [tip:efi/core] efivarfs: Make efivarfs_file_ioctl() static tip-bot for Peter Jones <tipbot@zytor.com> - 2016-05-07 08:40 +0200
  [PATCH 4/5] efi: Merge boolean flag arguments Matt Fleming <matt@codeblueprint.co.uk> - 2016-05-06 23:50 +0200
    [tip:efi/core] efi: Merge boolean flag arguments tip-bot for Julia Lawall <tipbot@zytor.com> - 2016-05-07 08:40 +0200
  [PATCH 3/5] efi/capsule: Move 'capsule' to the stack in efi_capsule_supported() Matt Fleming <matt@codeblueprint.co.uk> - 2016-05-06 23:50 +0200
    [tip:efi/core] efi/capsule: Move 'capsule' to the stack in  efi_capsule_supported() tip-bot for Matt Fleming <tipbot@zytor.com> - 2016-05-07 08:40 +0200
  [PATCH 2/5] efibc: Fix excessive stack footprint warning Matt Fleming <matt@codeblueprint.co.uk> - 2016-05-06 23:50 +0200
    [tip:efi/core] efibc: Fix excessive stack footprint warning tip-bot for Jeremy Compostella <tipbot@zytor.com> - 2016-05-07 08:40 +0200
    RE: [PATCH 2/5] efibc: Fix excessive stack footprint warning "Elliott, Robert (Persistent Memory)" <elliott@hpe.com> - 2016-05-10 01:50 +0200
      Re: [PATCH 2/5] efibc: Fix excessive stack footprint warning jeremy.compostella@intel.com (Compostella, Jeremy) - 2016-05-10 10:50 +0200
        Re: [PATCH 2/5] efibc: Fix excessive stack footprint warning Matt Fleming <matt@codeblueprint.co.uk> - 2016-05-11 14:50 +0200
          Re: [PATCH 2/5] efibc: Fix excessive stack footprint warning jeremy.compostella@intel.com (Compostella, Jeremy) - 2016-05-11 17:20 +0200

csiph-web