Skip to contentSkip to conversation

mm-early_ioremap-add-null-pointer-checks-to-prevent-null-pointer-dereference.patch removed from -mm tree

merged mm-stable Andrew Morton 1 participant 1 message Jan 14, 2025

lore
Share & tools
lore

Andrew Morton

author tree notice Applied
#0 lore raw

The quilt patch titled
Subject: mm/early_ioremap: add null pointer checks to prevent NULL-pointer dereference
has been removed from the -mm tree. Its filename was
mm-early_ioremap-add-null-pointer-checks-to-prevent-null-pointer-dereference.patch

This patch was dropped because it was merged into the mm-stable branch of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm

------------------------------------------------------
From: Guo Weikang <[email protected]>
Subject: mm/early_ioremap: add null pointer checks to prevent NULL-pointer dereference
Date: Thu, 12 Dec 2024 18:10:00 +0800

The early_ioremap interface can fail and return NULL in certain cases. To prevent NULL-pointer dereference crashes, fixed issues in the acpi_extlog and copy_early_mem interfaces, improving robustness when handling early memory.

Cc Ard Biesheuvel <[email protected]>
Cc Arnd Bergmann <[email protected]>
Cc Baoquan He <[email protected]>
Cc Borislav Petkov (AMD) <[email protected]>
Cc Dave Hansen <[email protected]>
Cc H. Peter Anvin <[email protected]>
Cc Ingo Molnar <[email protected]>
Cc Ingo Molnar <[email protected]>
Cc Jason A. Donenfeld <[email protected]>
Cc Julian Stecklina <[email protected]>
Cc Kevin Loughlin <[email protected]>
Cc Len Brown <[email protected]>
Cc Rafael J. Wysocki <[email protected]>
Cc "Rafael J. Wysocki" <[email protected]>
Cc Thomas Gleixner <[email protected]>
Cc Xin Li (Intel) <[email protected]>

---

 arch/x86/kernel/setup.c             |    5 ++++-
 drivers/acpi/acpi_extlog.c          |   14 ++++++++++++++
 include/asm-generic/early_ioremap.h |    2 +-
 mm/early_ioremap.c                  |    8 +++++++-
 4 files changed, 26 insertions(+), 3 deletions(-)
arch/x86/kernel/setup.c renamed from arch/x86/kernel/setup.c~mm-early_ioremap-add-null-pointer-checks-to-prevent-null-pointer-dereference +4 -1
@@ -259,6 +259,7 @@ static void __init relocate_initrd(void)
 	u64 ramdisk_image = get_ramdisk_image();
 	u64 ramdisk_size  = get_ramdisk_size();
 	u64 area_size     = PAGE_ALIGN(ramdisk_size);
+	int ret = 0;
 
 	/* We need to move the initrd down into directly mapped mem */
 	u64 relocated_ramdisk = memblock_phys_alloc_range(area_size, PAGE_SIZE, 0,
@@ -272,7 +273,9 @@ static void __init relocate_initrd(void)
 	printk(KERN_INFO "Allocated new RAMDISK: [mem %#010llx-%#010llx]\n",
 	       relocated_ramdisk, relocated_ramdisk + ramdisk_size - 1);
 
-	copy_from_early_mem((void *)initrd_start, ramdisk_image, ramdisk_size);
+	ret = copy_from_early_mem((void *)initrd_start, ramdisk_image, ramdisk_size);
+	if (ret)
+		panic("Copy RAMDISK failed\n");
 
 	printk(KERN_INFO "Move RAMDISK from [mem %#010llx-%#010llx] to"
 		" [mem %#010llx-%#010llx]\n",
drivers/acpi/acpi_extlog.c renamed from drivers/acpi/acpi_extlog.c~mm-early_ioremap-add-null-pointer-checks-to-prevent-null-pointer-dereference +14 -0
@@ -251,6 +251,10 @@ static int __init extlog_init(void)
 	}
 
 	extlog_l1_hdr = acpi_os_map_iomem(l1_dirbase, l1_hdr_size);
+	if (!extlog_l1_hdr) {
+		rc = -ENOMEM;
+		goto err_release_l1_hdr;
+	}
 	l1_head = (struct extlog_l1_head *)extlog_l1_hdr;
 	l1_size = l1_head->total_len;
 	l1_percpu_entry = l1_head->entries;
@@ -268,6 +272,10 @@ static int __init extlog_init(void)
 		goto err;
 	}
 	extlog_l1_addr = acpi_os_map_iomem(l1_dirbase, l1_size);
+	if (!extlog_l1_addr) {
+		rc = -ENOMEM;
+		goto err_release_l1_dir;
+	}
 	l1_entry_base = (u64 *)((u8 *)extlog_l1_addr + l1_hdr_size);
 
 	/* remap elog table */
@@ -279,6 +287,10 @@ static int __init extlog_init(void)
 		goto err_release_l1_dir;
 	}
 	elog_addr = acpi_os_map_iomem(elog_base, elog_size);
+	if (!elog_addr) {
+		rc = -ENOMEM;
+		goto err_release_elog;
+	}
 
 	rc = -ENOMEM;
 	/* allocate buffer to save elog record */
@@ -300,6 +312,8 @@ err_release_l1_dir:
 	if (extlog_l1_addr)
 		acpi_os_unmap_iomem(extlog_l1_addr, l1_size);
 	release_mem_region(l1_dirbase, l1_size);
+err_release_l1_hdr:
+	release_mem_region(l1_dirbase, l1_hdr_size);
 err:
 	pr_warn(FW_BUG "Extended error log disabled because of problems parsing f/w tables\n");
 	return rc;
include/asm-generic/early_ioremap.h renamed from include/asm-generic/early_ioremap.h~mm-early_ioremap-add-null-pointer-checks-to-prevent-null-pointer-dereference +1 -1
@@ -35,7 +35,7 @@ extern void early_ioremap_reset(void);
 /*
  * Early copy from unmapped memory to kernel mapped memory.
  */
-extern void copy_from_early_mem(void *dest, phys_addr_t src,
+extern int copy_from_early_mem(void *dest, phys_addr_t src,
 				unsigned long size);
 
 #else
mm/early_ioremap.c renamed from mm/early_ioremap.c~mm-early_ioremap-add-null-pointer-checks-to-prevent-null-pointer-dereference +7 -1
@@ -245,7 +245,10 @@ early_memremap_prot(resource_size_t phys
 
 #define MAX_MAP_CHUNK	(NR_FIX_BTMAPS << PAGE_SHIFT)
 
-void __init copy_from_early_mem(void *dest, phys_addr_t src, unsigned long size)
+/*
+ * If no empty slot, handle that and return -ENOMEM.
+ */
+int __init copy_from_early_mem(void *dest, phys_addr_t src, unsigned long size)
 {
 	unsigned long slop, clen;
 	char *p;
@@ -256,12 +259,15 @@ void __init copy_from_early_mem(void *de
 		if (clen > MAX_MAP_CHUNK - slop)
 			clen = MAX_MAP_CHUNK - slop;
 		p = early_memremap(src & PAGE_MASK, clen + slop);
+		if (!p)
+			return -ENOMEM;
 		memcpy(dest, p + slop, clen);
 		early_memunmap(p, clen + slop);
 		dest += clen;
 		src += clen;
 		size -= clen;
 	}
+	return 0;
 }
 
 #else /* CONFIG_MMU */

_

Patches currently in -mm which might be from [email protected] are

mm-memblock-add-memblock_alloc_or_panic-interface.patch arch-s390-save_area_alloc-default-failure-behavior-changed-to-panic.patch