tmakin/ack-tegra
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

firmware: qcom: uefisecapp: fix efivars registration race

Browse Source 
commit da8d493a80993972c427002684d0742560f3be4a upstream.

Since the conversion to using the TZ allocator, the efivars service is
registered before the memory pool has been allocated, something which
can lead to a NULL-pointer dereference in case of a racing EFI variable
access.

Make sure that all resources have been set up before registering the
efivars.

Fixes: 6612103ec3 ("firmware: qcom: qseecom: convert to using the TZ allocator")
Cc: stable@vger.kernel.org	# 6.11
Cc: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
Signed-off-by: Johan Hovold <johan+linaro@kernel.org>
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Reviewed-by: Maximilian Luz <luzmaximilian@gmail.com>
Reviewed-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
Link: https://lore.kernel.org/r/20250120151000.13870-1-johan+linaro@kernel.org
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Johan Hovold
2025-01-20 16:10:00 +01:00
committed by Greg Kroah-Hartman
parent 54ccfef437
commit c4e37b381a
1 changed files with 9 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
drivers/firmware/qcom/qcom_qseecom_uefisecapp.c
+9 -9
View File
@@ -814,15 +814,6 @@ static int qcom_uefisecapp_probe(struct auxiliary_device *aux_dev,
qcuefi->client = container_of(aux_dev, struct qseecom_client, aux_dev);
auxiliary_set_drvdata(aux_dev, qcuefi);
status = qcuefi_set_reference(qcuefi);
if (status)
return status;
status = efivars_register(&qcuefi->efivars, &qcom_efivar_ops);
if (status)
qcuefi_set_reference(NULL);
memset(&pool_config, 0, sizeof(pool_config));
pool_config.initial_size = SZ_4K;
pool_config.policy = QCOM_TZMEM_POLICY_MULTIPLIER;
@@ -833,6 +824,15 @@ static int qcom_uefisecapp_probe(struct auxiliary_device *aux_dev,
if (IS_ERR(qcuefi->mempool))
return PTR_ERR(qcuefi->mempool);
auxiliary_set_drvdata(aux_dev, qcuefi);
status = qcuefi_set_reference(qcuefi);
if (status)
return status;
status = efivars_register(&qcuefi->efivars, &qcom_efivar_ops);
if (status)
qcuefi_set_reference(NULL);
return status;
}