forked from mirrors/linux
		
	 89f9a1e876
			
		
	
	
		89f9a1e876
		
	
	
	
	
		
			
			On the time to free xbc memory in xbc_exit(), memblock may has handed
over memory to buddy allocator. So it doesn't make sense to free memory
back to memblock. memblock_free() called by xbc_exit() even causes UAF bugs
on architectures with CONFIG_ARCH_KEEP_MEMBLOCK disabled like x86.
Following KASAN logs shows this case.
This patch fixes the xbc memory free problem by calling memblock_free()
in early xbc init error rewind path and calling memblock_free_late() in
xbc exit path to free memory to buddy allocator.
[    9.410890] ==================================================================
[    9.418962] BUG: KASAN: use-after-free in memblock_isolate_range+0x12d/0x260
[    9.426850] Read of size 8 at addr ffff88845dd30000 by task swapper/0/1
[    9.435901] CPU: 9 PID: 1 Comm: swapper/0 Tainted: G     U             6.9.0-rc3-00208-g586b5dfb51b9 #5
[    9.446403] Hardware name: Intel Corporation RPLP LP5 (CPU:RaptorLake)/RPLP LP5 (ID:13), BIOS IRPPN02.01.01.00.00.19.015.D-00000000 Dec 28 2023
[    9.460789] Call Trace:
[    9.463518]  <TASK>
[    9.465859]  dump_stack_lvl+0x53/0x70
[    9.469949]  print_report+0xce/0x610
[    9.473944]  ? __virt_addr_valid+0xf5/0x1b0
[    9.478619]  ? memblock_isolate_range+0x12d/0x260
[    9.483877]  kasan_report+0xc6/0x100
[    9.487870]  ? memblock_isolate_range+0x12d/0x260
[    9.493125]  memblock_isolate_range+0x12d/0x260
[    9.498187]  memblock_phys_free+0xb4/0x160
[    9.502762]  ? __pfx_memblock_phys_free+0x10/0x10
[    9.508021]  ? mutex_unlock+0x7e/0xd0
[    9.512111]  ? __pfx_mutex_unlock+0x10/0x10
[    9.516786]  ? kernel_init_freeable+0x2d4/0x430
[    9.521850]  ? __pfx_kernel_init+0x10/0x10
[    9.526426]  xbc_exit+0x17/0x70
[    9.529935]  kernel_init+0x38/0x1e0
[    9.533829]  ? _raw_spin_unlock_irq+0xd/0x30
[    9.538601]  ret_from_fork+0x2c/0x50
[    9.542596]  ? __pfx_kernel_init+0x10/0x10
[    9.547170]  ret_from_fork_asm+0x1a/0x30
[    9.551552]  </TASK>
[    9.555649] The buggy address belongs to the physical page:
[    9.561875] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x1 pfn:0x45dd30
[    9.570821] flags: 0x200000000000000(node=0|zone=2)
[    9.576271] page_type: 0xffffffff()
[    9.580167] raw: 0200000000000000 ffffea0011774c48 ffffea0012ba1848 0000000000000000
[    9.588823] raw: 0000000000000001 0000000000000000 00000000ffffffff 0000000000000000
[    9.597476] page dumped because: kasan: bad access detected
[    9.605362] Memory state around the buggy address:
[    9.610714]  ffff88845dd2ff00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[    9.618786]  ffff88845dd2ff80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[    9.626857] >ffff88845dd30000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[    9.634930]                    ^
[    9.638534]  ffff88845dd30080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[    9.646605]  ffff88845dd30100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[    9.654675] ==================================================================
Link: https://lore.kernel.org/all/20240414114944.1012359-1-qiang4.zhang@linux.intel.com/
Fixes: 40caa127f3 ("init: bootconfig: Remove all bootconfig data when the init memory is removed")
Cc: Stable@vger.kernel.org
Signed-off-by: Qiang Zhang <qiang4.zhang@intel.com>
Acked-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
		
	
			
		
			
				
	
	
		
			308 lines
		
	
	
	
		
			9.3 KiB
		
	
	
	
		
			C
		
	
	
	
	
	
			
		
		
	
	
			308 lines
		
	
	
	
		
			9.3 KiB
		
	
	
	
		
			C
		
	
	
	
	
	
| /* SPDX-License-Identifier: GPL-2.0 */
 | |
| #ifndef _LINUX_XBC_H
 | |
| #define _LINUX_XBC_H
 | |
| /*
 | |
|  * Extra Boot Config
 | |
|  * Copyright (C) 2019 Linaro Ltd.
 | |
|  * Author: Masami Hiramatsu <mhiramat@kernel.org>
 | |
|  */
 | |
| 
 | |
| #ifdef __KERNEL__
 | |
| #include <linux/kernel.h>
 | |
| #include <linux/types.h>
 | |
| bool __init cmdline_has_extra_options(void);
 | |
| #else /* !__KERNEL__ */
 | |
| /*
 | |
|  * NOTE: This is only for tools/bootconfig, because tools/bootconfig will
 | |
|  * run the parser sanity test.
 | |
|  * This does NOT mean linux/bootconfig.h is available in the user space.
 | |
|  * However, if you change this file, please make sure the tools/bootconfig
 | |
|  * has no issue on building and running.
 | |
|  */
 | |
| #endif
 | |
| 
 | |
| #define BOOTCONFIG_MAGIC	"#BOOTCONFIG\n"
 | |
| #define BOOTCONFIG_MAGIC_LEN	12
 | |
| #define BOOTCONFIG_ALIGN_SHIFT	2
 | |
| #define BOOTCONFIG_ALIGN	(1 << BOOTCONFIG_ALIGN_SHIFT)
 | |
| #define BOOTCONFIG_ALIGN_MASK	(BOOTCONFIG_ALIGN - 1)
 | |
| 
 | |
| /**
 | |
|  * xbc_calc_checksum() - Calculate checksum of bootconfig
 | |
|  * @data: Bootconfig data.
 | |
|  * @size: The size of the bootconfig data.
 | |
|  *
 | |
|  * Calculate the checksum value of the bootconfig data.
 | |
|  * The checksum will be used with the BOOTCONFIG_MAGIC and the size for
 | |
|  * embedding the bootconfig in the initrd image.
 | |
|  */
 | |
| static inline __init uint32_t xbc_calc_checksum(void *data, uint32_t size)
 | |
| {
 | |
| 	unsigned char *p = data;
 | |
| 	uint32_t ret = 0;
 | |
| 
 | |
| 	while (size--)
 | |
| 		ret += *p++;
 | |
| 
 | |
| 	return ret;
 | |
| }
 | |
| 
 | |
| /* XBC tree node */
 | |
| struct xbc_node {
 | |
| 	uint16_t next;
 | |
| 	uint16_t child;
 | |
| 	uint16_t parent;
 | |
| 	uint16_t data;
 | |
| } __attribute__ ((__packed__));
 | |
| 
 | |
| #define XBC_KEY		0
 | |
| #define XBC_VALUE	(1 << 15)
 | |
| /* Maximum size of boot config is 32KB - 1 */
 | |
| #define XBC_DATA_MAX	(XBC_VALUE - 1)
 | |
| 
 | |
| #define XBC_NODE_MAX	8192
 | |
| #define XBC_KEYLEN_MAX	256
 | |
| #define XBC_DEPTH_MAX	16
 | |
| 
 | |
| /* Node tree access raw APIs */
 | |
| struct xbc_node * __init xbc_root_node(void);
 | |
| int __init xbc_node_index(struct xbc_node *node);
 | |
| struct xbc_node * __init xbc_node_get_parent(struct xbc_node *node);
 | |
| struct xbc_node * __init xbc_node_get_child(struct xbc_node *node);
 | |
| struct xbc_node * __init xbc_node_get_next(struct xbc_node *node);
 | |
| const char * __init xbc_node_get_data(struct xbc_node *node);
 | |
| 
 | |
| /**
 | |
|  * xbc_node_is_value() - Test the node is a value node
 | |
|  * @node: An XBC node.
 | |
|  *
 | |
|  * Test the @node is a value node and return true if a value node, false if not.
 | |
|  */
 | |
| static inline __init bool xbc_node_is_value(struct xbc_node *node)
 | |
| {
 | |
| 	return node->data & XBC_VALUE;
 | |
| }
 | |
| 
 | |
| /**
 | |
|  * xbc_node_is_key() - Test the node is a key node
 | |
|  * @node: An XBC node.
 | |
|  *
 | |
|  * Test the @node is a key node and return true if a key node, false if not.
 | |
|  */
 | |
| static inline __init bool xbc_node_is_key(struct xbc_node *node)
 | |
| {
 | |
| 	return !xbc_node_is_value(node);
 | |
| }
 | |
| 
 | |
| /**
 | |
|  * xbc_node_is_array() - Test the node is an arraied value node
 | |
|  * @node: An XBC node.
 | |
|  *
 | |
|  * Test the @node is an arraied value node.
 | |
|  */
 | |
| static inline __init bool xbc_node_is_array(struct xbc_node *node)
 | |
| {
 | |
| 	return xbc_node_is_value(node) && node->child != 0;
 | |
| }
 | |
| 
 | |
| /**
 | |
|  * xbc_node_is_leaf() - Test the node is a leaf key node
 | |
|  * @node: An XBC node.
 | |
|  *
 | |
|  * Test the @node is a leaf key node which is a key node and has a value node
 | |
|  * or no child. Returns true if it is a leaf node, or false if not.
 | |
|  * Note that the leaf node can have subkey nodes in addition to the
 | |
|  * value node.
 | |
|  */
 | |
| static inline __init bool xbc_node_is_leaf(struct xbc_node *node)
 | |
| {
 | |
| 	return xbc_node_is_key(node) &&
 | |
| 		(!node->child || xbc_node_is_value(xbc_node_get_child(node)));
 | |
| }
 | |
| 
 | |
| /* Tree-based key-value access APIs */
 | |
| struct xbc_node * __init xbc_node_find_subkey(struct xbc_node *parent,
 | |
| 					     const char *key);
 | |
| 
 | |
| const char * __init xbc_node_find_value(struct xbc_node *parent,
 | |
| 					const char *key,
 | |
| 					struct xbc_node **vnode);
 | |
| 
 | |
| struct xbc_node * __init xbc_node_find_next_leaf(struct xbc_node *root,
 | |
| 						 struct xbc_node *leaf);
 | |
| 
 | |
| const char * __init xbc_node_find_next_key_value(struct xbc_node *root,
 | |
| 						 struct xbc_node **leaf);
 | |
| 
 | |
| /**
 | |
|  * xbc_find_value() - Find a value which matches the key
 | |
|  * @key: Search key
 | |
|  * @vnode: A container pointer of XBC value node.
 | |
|  *
 | |
|  * Search a value whose key matches @key from whole of XBC tree and return
 | |
|  * the value if found. Found value node is stored in *@vnode.
 | |
|  * Note that this can return 0-length string and store NULL in *@vnode for
 | |
|  * key-only (non-value) entry.
 | |
|  */
 | |
| static inline const char * __init
 | |
| xbc_find_value(const char *key, struct xbc_node **vnode)
 | |
| {
 | |
| 	return xbc_node_find_value(NULL, key, vnode);
 | |
| }
 | |
| 
 | |
| /**
 | |
|  * xbc_find_node() - Find a node which matches the key
 | |
|  * @key: Search key
 | |
|  *
 | |
|  * Search a (key) node whose key matches @key from whole of XBC tree and
 | |
|  * return the node if found. If not found, returns NULL.
 | |
|  */
 | |
| static inline struct xbc_node * __init xbc_find_node(const char *key)
 | |
| {
 | |
| 	return xbc_node_find_subkey(NULL, key);
 | |
| }
 | |
| 
 | |
| /**
 | |
|  * xbc_node_get_subkey() - Return the first subkey node if exists
 | |
|  * @node: Parent node
 | |
|  *
 | |
|  * Return the first subkey node of the @node. If the @node has no child
 | |
|  * or only value node, this will return NULL.
 | |
|  */
 | |
| static inline struct xbc_node * __init xbc_node_get_subkey(struct xbc_node *node)
 | |
| {
 | |
| 	struct xbc_node *child = xbc_node_get_child(node);
 | |
| 
 | |
| 	if (child && xbc_node_is_value(child))
 | |
| 		return xbc_node_get_next(child);
 | |
| 	else
 | |
| 		return child;
 | |
| }
 | |
| 
 | |
| /**
 | |
|  * xbc_array_for_each_value() - Iterate value nodes on an array
 | |
|  * @anode: An XBC arraied value node
 | |
|  * @value: A value
 | |
|  *
 | |
|  * Iterate array value nodes and values starts from @anode. This is expected to
 | |
|  * be used with xbc_find_value() and xbc_node_find_value(), so that user can
 | |
|  * process each array entry node.
 | |
|  */
 | |
| #define xbc_array_for_each_value(anode, value)				\
 | |
| 	for (value = xbc_node_get_data(anode); anode != NULL ;		\
 | |
| 	     anode = xbc_node_get_child(anode),				\
 | |
| 	     value = anode ? xbc_node_get_data(anode) : NULL)
 | |
| 
 | |
| /**
 | |
|  * xbc_node_for_each_child() - Iterate child nodes
 | |
|  * @parent: An XBC node.
 | |
|  * @child: Iterated XBC node.
 | |
|  *
 | |
|  * Iterate child nodes of @parent. Each child nodes are stored to @child.
 | |
|  * The @child can be mixture of a value node and subkey nodes.
 | |
|  */
 | |
| #define xbc_node_for_each_child(parent, child)				\
 | |
| 	for (child = xbc_node_get_child(parent); child != NULL ;	\
 | |
| 	     child = xbc_node_get_next(child))
 | |
| 
 | |
| /**
 | |
|  * xbc_node_for_each_subkey() - Iterate child subkey nodes
 | |
|  * @parent: An XBC node.
 | |
|  * @child: Iterated XBC node.
 | |
|  *
 | |
|  * Iterate subkey nodes of @parent. Each child nodes are stored to @child.
 | |
|  * The @child is only the subkey node.
 | |
|  */
 | |
| #define xbc_node_for_each_subkey(parent, child)				\
 | |
| 	for (child = xbc_node_get_subkey(parent); child != NULL ;	\
 | |
| 	     child = xbc_node_get_next(child))
 | |
| 
 | |
| /**
 | |
|  * xbc_node_for_each_array_value() - Iterate array entries of geven key
 | |
|  * @node: An XBC node.
 | |
|  * @key: A key string searched under @node
 | |
|  * @anode: Iterated XBC node of array entry.
 | |
|  * @value: Iterated value of array entry.
 | |
|  *
 | |
|  * Iterate array entries of given @key under @node. Each array entry node
 | |
|  * is stored to @anode and @value. If the @node doesn't have @key node,
 | |
|  * it does nothing.
 | |
|  * Note that even if the found key node has only one value (not array)
 | |
|  * this executes block once. However, if the found key node has no value
 | |
|  * (key-only node), this does nothing. So don't use this for testing the
 | |
|  * key-value pair existence.
 | |
|  */
 | |
| #define xbc_node_for_each_array_value(node, key, anode, value)		\
 | |
| 	for (value = xbc_node_find_value(node, key, &anode); value != NULL; \
 | |
| 	     anode = xbc_node_get_child(anode),				\
 | |
| 	     value = anode ? xbc_node_get_data(anode) : NULL)
 | |
| 
 | |
| /**
 | |
|  * xbc_node_for_each_key_value() - Iterate key-value pairs under a node
 | |
|  * @node: An XBC node.
 | |
|  * @knode: Iterated key node
 | |
|  * @value: Iterated value string
 | |
|  *
 | |
|  * Iterate key-value pairs under @node. Each key node and value string are
 | |
|  * stored in @knode and @value respectively.
 | |
|  */
 | |
| #define xbc_node_for_each_key_value(node, knode, value)			\
 | |
| 	for (knode = NULL, value = xbc_node_find_next_key_value(node, &knode);\
 | |
| 	     knode != NULL; value = xbc_node_find_next_key_value(node, &knode))
 | |
| 
 | |
| /**
 | |
|  * xbc_for_each_key_value() - Iterate key-value pairs
 | |
|  * @knode: Iterated key node
 | |
|  * @value: Iterated value string
 | |
|  *
 | |
|  * Iterate key-value pairs in whole XBC tree. Each key node and value string
 | |
|  * are stored in @knode and @value respectively.
 | |
|  */
 | |
| #define xbc_for_each_key_value(knode, value)				\
 | |
| 	xbc_node_for_each_key_value(NULL, knode, value)
 | |
| 
 | |
| /* Compose partial key */
 | |
| int __init xbc_node_compose_key_after(struct xbc_node *root,
 | |
| 			struct xbc_node *node, char *buf, size_t size);
 | |
| 
 | |
| /**
 | |
|  * xbc_node_compose_key() - Compose full key string of the XBC node
 | |
|  * @node: An XBC node.
 | |
|  * @buf: A buffer to store the key.
 | |
|  * @size: The size of the @buf.
 | |
|  *
 | |
|  * Compose the full-length key of the @node into @buf. Returns the total
 | |
|  * length of the key stored in @buf. Or returns -EINVAL if @node is NULL,
 | |
|  * and -ERANGE if the key depth is deeper than max depth.
 | |
|  */
 | |
| static inline int __init xbc_node_compose_key(struct xbc_node *node,
 | |
| 					      char *buf, size_t size)
 | |
| {
 | |
| 	return xbc_node_compose_key_after(NULL, node, buf, size);
 | |
| }
 | |
| 
 | |
| /* XBC node initializer */
 | |
| int __init xbc_init(const char *buf, size_t size, const char **emsg, int *epos);
 | |
| 
 | |
| /* XBC node and size information */
 | |
| int __init xbc_get_info(int *node_size, size_t *data_size);
 | |
| 
 | |
| /* XBC cleanup data structures */
 | |
| void __init _xbc_exit(bool early);
 | |
| 
 | |
| static inline void xbc_exit(void)
 | |
| {
 | |
| 	_xbc_exit(false);
 | |
| }
 | |
| 
 | |
| /* XBC embedded bootconfig data in kernel */
 | |
| #ifdef CONFIG_BOOT_CONFIG_EMBED
 | |
| const char * __init xbc_get_embedded_bootconfig(size_t *size);
 | |
| #else
 | |
| static inline const char *xbc_get_embedded_bootconfig(size_t *size)
 | |
| {
 | |
| 	return NULL;
 | |
| }
 | |
| #endif
 | |
| 
 | |
| #endif
 |