0f8ac65a1e
[ Upstream commit 0e8d2444168dd519fea501599d150e62718ed2fe ] If SetVariable at runtime is not supported by the firmware we never assign a callback for that function. At the same time mount the efivarfs as RO so no one can call that. However, we never check the permission flags when someone remounts the filesystem as RW. As a result this leads to a crash looking like this: $ mount -o remount,rw /sys/firmware/efi/efivars $ efi-updatevar -f PK.auth PK [ 303.279166] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 [ 303.280482] Mem abort info: [ 303.280854] ESR = 0x0000000086000004 [ 303.281338] EC = 0x21: IABT (current EL), IL = 32 bits [ 303.282016] SET = 0, FnV = 0 [ 303.282414] EA = 0, S1PTW = 0 [ 303.282821] FSC = 0x04: level 0 translation fault [ 303.283771] user pgtable: 4k pages, 48-bit VAs, pgdp=000000004258c000 [ 303.284913] [0000000000000000] pgd=0000000000000000, p4d=0000000000000000 [ 303.286076] Internal error: Oops: 0000000086000004 [#1] PREEMPT SMP [ 303.286936] Modules linked in: qrtr tpm_tis tpm_tis_core crct10dif_ce arm_smccc_trng rng_core drm fuse ip_tables x_tables ipv6 [ 303.288586] CPU: 1 PID: 755 Comm: efi-updatevar Not tainted 6.3.0-rc1-00108-gc7d0c4695c68 #1 [ 303.289748] Hardware name: Unknown Unknown Product/Unknown Product, BIOS 2023.04-00627-g88336918701d 04/01/2023 [ 303.291150] pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 303.292123] pc : 0x0 [ 303.292443] lr : efivar_set_variable_locked+0x74/0xec [ 303.293156] sp : ffff800008673c10 [ 303.293619] x29: ffff800008673c10 x28: ffff0000037e8000 x27: 0000000000000000 [ 303.294592] x26: 0000000000000800 x25: ffff000002467400 x24: 0000000000000027 [ 303.295572] x23: ffffd49ea9832000 x22: ffff0000020c9800 x21: ffff000002467000 [ 303.296566] x20: 0000000000000001 x19: 00000000000007fc x18: 0000000000000000 [ 303.297531] x17: 0000000000000000 x16: 0000000000000000 x15: 0000aaaac807ab54 [ 303.298495] x14: ed37489f673633c0 x13: 71c45c606de13f80 x12: 47464259e219acf4 [ 303.299453] x11: ffff000002af7b01 x10: 0000000000000003 x9 : 0000000000000002 [ 303.300431] x8 : 0000000000000010 x7 : ffffd49ea8973230 x6 : 0000000000a85201 [ 303.301412] x5 : 0000000000000000 x4 : ffff0000020c9800 x3 : 00000000000007fc [ 303.302370] x2 : 0000000000000027 x1 : ffff000002467400 x0 : ffff000002467000 [ 303.303341] Call trace: [ 303.303679] 0x0 [ 303.303938] efivar_entry_set_get_size+0x98/0x16c [ 303.304585] efivarfs_file_write+0xd0/0x1a4 [ 303.305148] vfs_write+0xc4/0x2e4 [ 303.305601] ksys_write+0x70/0x104 [ 303.306073] __arm64_sys_write+0x1c/0x28 [ 303.306622] invoke_syscall+0x48/0x114 [ 303.307156] el0_svc_common.constprop.0+0x44/0xec [ 303.307803] do_el0_svc+0x38/0x98 [ 303.308268] el0_svc+0x2c/0x84 [ 303.308702] el0t_64_sync_handler+0xf4/0x120 [ 303.309293] el0t_64_sync+0x190/0x194 [ 303.309794] Code: ???????? ???????? ???????? ???????? (????????) [ 303.310612] ---[ end trace 0000000000000000 ]--- Fix this by adding a .reconfigure() function to the fs operations which we can use to check the requested flags and deny anything that's not RO if the firmware doesn't implement SetVariable at runtime. Fixes: f88814cc2578 ("efi/efivars: Expose RT service availability via efivars abstraction") Signed-off-by: Ilias Apalodimas <ilias.apalodimas@linaro.org> Signed-off-by: Ard Biesheuvel <ardb@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org>
291 lines
6.5 KiB
C
Executable file
291 lines
6.5 KiB
C
Executable file
// SPDX-License-Identifier: GPL-2.0-only
|
|
/*
|
|
* Copyright (C) 2012 Red Hat, Inc.
|
|
* Copyright (C) 2012 Jeremy Kerr <jeremy.kerr@canonical.com>
|
|
*/
|
|
|
|
#include <linux/ctype.h>
|
|
#include <linux/efi.h>
|
|
#include <linux/fs.h>
|
|
#include <linux/fs_context.h>
|
|
#include <linux/module.h>
|
|
#include <linux/pagemap.h>
|
|
#include <linux/ucs2_string.h>
|
|
#include <linux/slab.h>
|
|
#include <linux/magic.h>
|
|
#include <linux/printk.h>
|
|
|
|
#include "internal.h"
|
|
|
|
LIST_HEAD(efivarfs_list);
|
|
|
|
static void efivarfs_evict_inode(struct inode *inode)
|
|
{
|
|
clear_inode(inode);
|
|
}
|
|
|
|
static const struct super_operations efivarfs_ops = {
|
|
.statfs = simple_statfs,
|
|
.drop_inode = generic_delete_inode,
|
|
.evict_inode = efivarfs_evict_inode,
|
|
};
|
|
|
|
/*
|
|
* Compare two efivarfs file names.
|
|
*
|
|
* An efivarfs filename is composed of two parts,
|
|
*
|
|
* 1. A case-sensitive variable name
|
|
* 2. A case-insensitive GUID
|
|
*
|
|
* So we need to perform a case-sensitive match on part 1 and a
|
|
* case-insensitive match on part 2.
|
|
*/
|
|
static int efivarfs_d_compare(const struct dentry *dentry,
|
|
unsigned int len, const char *str,
|
|
const struct qstr *name)
|
|
{
|
|
int guid = len - EFI_VARIABLE_GUID_LEN;
|
|
|
|
if (name->len != len)
|
|
return 1;
|
|
|
|
/* Case-sensitive compare for the variable name */
|
|
if (memcmp(str, name->name, guid))
|
|
return 1;
|
|
|
|
/* Case-insensitive compare for the GUID */
|
|
return strncasecmp(name->name + guid, str + guid, EFI_VARIABLE_GUID_LEN);
|
|
}
|
|
|
|
static int efivarfs_d_hash(const struct dentry *dentry, struct qstr *qstr)
|
|
{
|
|
unsigned long hash = init_name_hash(dentry);
|
|
const unsigned char *s = qstr->name;
|
|
unsigned int len = qstr->len;
|
|
|
|
if (!efivarfs_valid_name(s, len))
|
|
return -EINVAL;
|
|
|
|
while (len-- > EFI_VARIABLE_GUID_LEN)
|
|
hash = partial_name_hash(*s++, hash);
|
|
|
|
/* GUID is case-insensitive. */
|
|
while (len--)
|
|
hash = partial_name_hash(tolower(*s++), hash);
|
|
|
|
qstr->hash = end_name_hash(hash);
|
|
return 0;
|
|
}
|
|
|
|
static const struct dentry_operations efivarfs_d_ops = {
|
|
.d_compare = efivarfs_d_compare,
|
|
.d_hash = efivarfs_d_hash,
|
|
.d_delete = always_delete_dentry,
|
|
};
|
|
|
|
static struct dentry *efivarfs_alloc_dentry(struct dentry *parent, char *name)
|
|
{
|
|
struct dentry *d;
|
|
struct qstr q;
|
|
int err;
|
|
|
|
q.name = name;
|
|
q.len = strlen(name);
|
|
|
|
err = efivarfs_d_hash(parent, &q);
|
|
if (err)
|
|
return ERR_PTR(err);
|
|
|
|
d = d_alloc(parent, &q);
|
|
if (d)
|
|
return d;
|
|
|
|
return ERR_PTR(-ENOMEM);
|
|
}
|
|
|
|
static int efivarfs_callback(efi_char16_t *name16, efi_guid_t vendor,
|
|
unsigned long name_size, void *data)
|
|
{
|
|
struct super_block *sb = (struct super_block *)data;
|
|
struct efivar_entry *entry;
|
|
struct inode *inode = NULL;
|
|
struct dentry *dentry, *root = sb->s_root;
|
|
unsigned long size = 0;
|
|
char *name;
|
|
int len;
|
|
int err = -ENOMEM;
|
|
bool is_removable = false;
|
|
|
|
entry = kzalloc(sizeof(*entry), GFP_KERNEL);
|
|
if (!entry)
|
|
return err;
|
|
|
|
memcpy(entry->var.VariableName, name16, name_size);
|
|
memcpy(&(entry->var.VendorGuid), &vendor, sizeof(efi_guid_t));
|
|
|
|
len = ucs2_utf8size(entry->var.VariableName);
|
|
|
|
/* name, plus '-', plus GUID, plus NUL*/
|
|
name = kmalloc(len + 1 + EFI_VARIABLE_GUID_LEN + 1, GFP_KERNEL);
|
|
if (!name)
|
|
goto fail;
|
|
|
|
ucs2_as_utf8(name, entry->var.VariableName, len);
|
|
|
|
if (efivar_variable_is_removable(entry->var.VendorGuid, name, len))
|
|
is_removable = true;
|
|
|
|
name[len] = '-';
|
|
|
|
efi_guid_to_str(&entry->var.VendorGuid, name + len + 1);
|
|
|
|
name[len + EFI_VARIABLE_GUID_LEN+1] = '\0';
|
|
|
|
/* replace invalid slashes like kobject_set_name_vargs does for /sys/firmware/efi/vars. */
|
|
strreplace(name, '/', '!');
|
|
|
|
inode = efivarfs_get_inode(sb, d_inode(root), S_IFREG | 0644, 0,
|
|
is_removable);
|
|
if (!inode)
|
|
goto fail_name;
|
|
|
|
dentry = efivarfs_alloc_dentry(root, name);
|
|
if (IS_ERR(dentry)) {
|
|
err = PTR_ERR(dentry);
|
|
goto fail_inode;
|
|
}
|
|
|
|
efivar_entry_size(entry, &size);
|
|
err = efivar_entry_add(entry, &efivarfs_list);
|
|
if (err)
|
|
goto fail_inode;
|
|
|
|
/* copied by the above to local storage in the dentry. */
|
|
kfree(name);
|
|
|
|
inode_lock(inode);
|
|
inode->i_private = entry;
|
|
i_size_write(inode, size + sizeof(entry->var.Attributes));
|
|
inode_unlock(inode);
|
|
d_add(dentry, inode);
|
|
|
|
return 0;
|
|
|
|
fail_inode:
|
|
iput(inode);
|
|
fail_name:
|
|
kfree(name);
|
|
fail:
|
|
kfree(entry);
|
|
return err;
|
|
}
|
|
|
|
static int efivarfs_destroy(struct efivar_entry *entry, void *data)
|
|
{
|
|
int err = efivar_entry_remove(entry);
|
|
|
|
if (err)
|
|
return err;
|
|
kfree(entry);
|
|
return 0;
|
|
}
|
|
|
|
static int efivarfs_fill_super(struct super_block *sb, struct fs_context *fc)
|
|
{
|
|
struct inode *inode = NULL;
|
|
struct dentry *root;
|
|
int err;
|
|
|
|
sb->s_maxbytes = MAX_LFS_FILESIZE;
|
|
sb->s_blocksize = PAGE_SIZE;
|
|
sb->s_blocksize_bits = PAGE_SHIFT;
|
|
sb->s_magic = EFIVARFS_MAGIC;
|
|
sb->s_op = &efivarfs_ops;
|
|
sb->s_d_op = &efivarfs_d_ops;
|
|
sb->s_time_gran = 1;
|
|
|
|
if (!efivar_supports_writes())
|
|
sb->s_flags |= SB_RDONLY;
|
|
|
|
inode = efivarfs_get_inode(sb, NULL, S_IFDIR | 0755, 0, true);
|
|
if (!inode)
|
|
return -ENOMEM;
|
|
inode->i_op = &efivarfs_dir_inode_operations;
|
|
|
|
root = d_make_root(inode);
|
|
sb->s_root = root;
|
|
if (!root)
|
|
return -ENOMEM;
|
|
|
|
INIT_LIST_HEAD(&efivarfs_list);
|
|
|
|
err = efivar_init(efivarfs_callback, (void *)sb, true, &efivarfs_list);
|
|
if (err)
|
|
__efivar_entry_iter(efivarfs_destroy, &efivarfs_list, NULL, NULL);
|
|
|
|
return err;
|
|
}
|
|
|
|
static int efivarfs_get_tree(struct fs_context *fc)
|
|
{
|
|
return get_tree_single(fc, efivarfs_fill_super);
|
|
}
|
|
|
|
static int efivarfs_reconfigure(struct fs_context *fc)
|
|
{
|
|
if (!efivar_supports_writes() && !(fc->sb_flags & SB_RDONLY)) {
|
|
pr_err("Firmware does not support SetVariableRT. Can not remount with rw\n");
|
|
return -EINVAL;
|
|
}
|
|
|
|
return 0;
|
|
}
|
|
|
|
static const struct fs_context_operations efivarfs_context_ops = {
|
|
.get_tree = efivarfs_get_tree,
|
|
.reconfigure = efivarfs_reconfigure,
|
|
};
|
|
|
|
static int efivarfs_init_fs_context(struct fs_context *fc)
|
|
{
|
|
fc->ops = &efivarfs_context_ops;
|
|
return 0;
|
|
}
|
|
|
|
static void efivarfs_kill_sb(struct super_block *sb)
|
|
{
|
|
kill_litter_super(sb);
|
|
|
|
/* Remove all entries and destroy */
|
|
__efivar_entry_iter(efivarfs_destroy, &efivarfs_list, NULL, NULL);
|
|
}
|
|
|
|
static struct file_system_type efivarfs_type = {
|
|
.owner = THIS_MODULE,
|
|
.name = "efivarfs",
|
|
.init_fs_context = efivarfs_init_fs_context,
|
|
.kill_sb = efivarfs_kill_sb,
|
|
};
|
|
|
|
static __init int efivarfs_init(void)
|
|
{
|
|
if (!efivars_kobject())
|
|
return -ENODEV;
|
|
|
|
return register_filesystem(&efivarfs_type);
|
|
}
|
|
|
|
static __exit void efivarfs_exit(void)
|
|
{
|
|
unregister_filesystem(&efivarfs_type);
|
|
}
|
|
|
|
MODULE_AUTHOR("Matthew Garrett, Jeremy Kerr");
|
|
MODULE_DESCRIPTION("EFI Variable Filesystem");
|
|
MODULE_LICENSE("GPL");
|
|
MODULE_IMPORT_NS(ANDROID_GKI_VFS_EXPORT_ONLY);
|
|
MODULE_ALIAS_FS("efivarfs");
|
|
|
|
module_init(efivarfs_init);
|
|
module_exit(efivarfs_exit);
|