The following commit has been merged into the efi/urgent branch of tip:
Commit-ID: 2bab693a608bdf614b9fcd44083c5100f34b9f77
Gitweb: https://git.kernel.org/tip/2bab693a608bdf614b9fcd44083c5100f34b9f77
Author: Marc Zyngier <maz(a)kernel.org>
AuthorDate: Tue, 13 Jul 2021 19:43:26 +01:00
Committer: Ard Biesheuvel <ardb(a)kernel.org>
CommitterDate: Fri, 16 Jul 2021 18:05:49 +02:00
firmware/efi: Tell memblock about EFI iomem reservations
kexec_load_file() relies on the memblock infrastructure to avoid
stamping over regions of memory that are essential to the survival
of the system.
However, nobody seems to agree how to flag these regions as reserved,
and (for example) EFI only publishes its reservations in /proc/iomem
for the benefit of the traditional, userspace based kexec tool.
On arm64 platforms with GICv3, this can result in the payload being
placed at the location of the LPI tables. Shock, horror!
Let's augment the EFI reservation code with a memblock_reserve() call,
protecting our dear tables from the secondary kernel invasion.
Reported-by: Moritz Fischer <mdf(a)kernel.org>
Tested-by: Moritz Fischer <mdf(a)kernel.org>
Signed-off-by: Marc Zyngier <maz(a)kernel.org>
Cc: stable(a)vger.kernel.org
Cc: Ard Biesheuvel <ardb(a)kernel.org>
Cc: James Morse <james.morse(a)arm.com>
Cc: Catalin Marinas <catalin.marinas(a)arm.com>
Cc: Will Deacon <will(a)kernel.org>
Signed-off-by: Ard Biesheuvel <ardb(a)kernel.org>
---
drivers/firmware/efi/efi.c | 13 ++++++++++++-
1 file changed, 12 insertions(+), 1 deletion(-)
diff --git a/drivers/firmware/efi/efi.c b/drivers/firmware/efi/efi.c
index 4b7ee3f..847f33f 100644
--- a/drivers/firmware/efi/efi.c
+++ b/drivers/firmware/efi/efi.c
@@ -896,6 +896,7 @@ static int __init efi_memreserve_map_root(void)
static int efi_mem_reserve_iomem(phys_addr_t addr, u64 size)
{
struct resource *res, *parent;
+ int ret;
res = kzalloc(sizeof(struct resource), GFP_ATOMIC);
if (!res)
@@ -908,7 +909,17 @@ static int efi_mem_reserve_iomem(phys_addr_t addr, u64 size)
/* we expect a conflict with a 'System RAM' region */
parent = request_resource_conflict(&iomem_resource, res);
- return parent ? request_resource(parent, res) : 0;
+ ret = parent ? request_resource(parent, res) : 0;
+
+ /*
+ * Given that efi_mem_reserve_iomem() can be called at any
+ * time, only call memblock_reserve() if the architecture
+ * keeps the infrastructure around.
+ */
+ if (IS_ENABLED(CONFIG_ARCH_KEEP_MEMBLOCK) && !ret)
+ memblock_reserve(addr, size);
+
+ return ret;
}
int __ref efi_mem_reserve_persistent(phys_addr_t addr, u64 size)
The following commit has been merged into the timers/urgent branch of tip:
Commit-ID: 1a3402d93c73bf6bb4df6d7c2aac35abfc3c50e2
Gitweb: https://git.kernel.org/tip/1a3402d93c73bf6bb4df6d7c2aac35abfc3c50e2
Author: Frederic Weisbecker <frederic(a)kernel.org>
AuthorDate: Thu, 03 Jun 2021 01:15:59 +02:00
Committer: Frederic Weisbecker <frederic(a)kernel.org>
CommitterDate: Thu, 15 Jul 2021 01:20:10 +02:00
posix-cpu-timers: Fix rearm racing against process tick
Since the process wide cputime counter is started locklessly from
posix_cpu_timer_rearm(), it can be concurrently stopped by operations
on other timers from the same thread group, such as in the following
unlucky scenario:
CPU 0 CPU 1
----- -----
timer_settime(TIMER B)
posix_cpu_timer_rearm(TIMER A)
cpu_clock_sample_group()
(pct->timers_active already true)
handle_posix_cpu_timers()
check_process_timers()
stop_process_timers()
pct->timers_active = false
arm_timer(TIMER A)
tick -> run_posix_cpu_timers()
// sees !pct->timers_active, ignore
// our TIMER A
Fix this with simply locking process wide cputime counting start and
timer arm in the same block.
Acked-by: Peter Zijlstra (Intel) <peterz(a)infradead.org>
Signed-off-by: Frederic Weisbecker <frederic(a)kernel.org>
Fixes: 60f2ceaa8111 ("posix-cpu-timers: Remove unnecessary locking around cpu_clock_sample_group")
Cc: stable(a)vger.kernel.org
Cc: Oleg Nesterov <oleg(a)redhat.com>
Cc: Thomas Gleixner <tglx(a)linutronix.de>
Cc: Ingo Molnar <mingo(a)kernel.org>
Cc: Eric W. Biederman <ebiederm(a)xmission.com>
---
kernel/time/posix-cpu-timers.c | 10 +++++-----
1 file changed, 5 insertions(+), 5 deletions(-)
diff --git a/kernel/time/posix-cpu-timers.c b/kernel/time/posix-cpu-timers.c
index 29a5e54..517be7f 100644
--- a/kernel/time/posix-cpu-timers.c
+++ b/kernel/time/posix-cpu-timers.c
@@ -991,6 +991,11 @@ static void posix_cpu_timer_rearm(struct k_itimer *timer)
if (!p)
goto out;
+ /* Protect timer list r/w in arm_timer() */
+ sighand = lock_task_sighand(p, &flags);
+ if (unlikely(sighand == NULL))
+ goto out;
+
/*
* Fetch the current sample and update the timer's expiry time.
*/
@@ -1001,11 +1006,6 @@ static void posix_cpu_timer_rearm(struct k_itimer *timer)
bump_cpu_timer(timer, now);
- /* Protect timer list r/w in arm_timer() */
- sighand = lock_task_sighand(p, &flags);
- if (unlikely(sighand == NULL))
- goto out;
-
/*
* Now re-arm for the new expiry time.
*/
> > How about linux 4.9 below, are they compliant with 802.11 standard or not?
>
> They are compliant.
>
> > Would they need additional patches to mitigate the aggregation attack?
>
> They need the backport of "[PATCH 04/18] cfg80211: mitigate A-MSDU
> aggregation attacks" to mitigate attacks. This patch has been backported
> to 4.4:
> https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=
> v4.4.275&id=daea7ff51861cec93ff7f561095d9048b673b51f
>
> So if you take all the patches that have been backported to 4.4 you
> should be OK.
>
> Cheers,
> Mathy
I get it now, thanks.
Best regards,
Zheng Yejian
When the CONFIG_ARM_LPAE is enabled on arm32, the physical address may
exceed 32 bits. In the devmem_is_allowed function, the physical address
is obtained through displacement of the physical page number.Without
explicit translation, the physical address may overflow and be truncated.
Use the PFN_PHYS macro to fix this bug.
This bug was initially introduced in v2.6.37 with commit:087aaffcdf9c91.
In v5.10, this code has been modified by commit:527701eda5f196.
Fixes: 527701eda5f196 ("lib: Add a generic version of devmem_is_allowed")
Fixes: 087aaffcdf9c91 ("ARM: implement CONFIG_STRICT_DEVMEM by disabling access to RAM via /dev/mem")
Cc: stable(a)vger.kernel.org # v2.6.37
Signed-off-by: Liang Wang <wangliang101(a)huawei.com>
---
lib/devmem_is_allowed.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/lib/devmem_is_allowed.c b/lib/devmem_is_allowed.c
index c0d67c541849..60be9e24bd57 100644
--- a/lib/devmem_is_allowed.c
+++ b/lib/devmem_is_allowed.c
@@ -19,7 +19,7 @@
*/
int devmem_is_allowed(unsigned long pfn)
{
- if (iomem_is_exclusive(pfn << PAGE_SHIFT))
+ if (iomem_is_exclusive(PFN_PHYS(pfn)))
return 0;
if (!page_is_ram(pfn))
return 1;
--
2.32.0