6.13-stable patches

added patches:
	efi-don-t-map-the-entire-mokvar-table-to-determine-its-size.patch

diff --git a/queue-6.13/efi-don-t-map-the-entire-mokvar-table-to-determine-its-size.patch b/queue-6.13/efi-don-t-map-the-entire-mokvar-table-to-determine-its-size.patch
new file mode 100644 (file)
index 0000000..6fc585f
--- /dev/null
+++ b/queue-6.13/efi-don-t-map-the-entire-mokvar-table-to-determine-its-size.patch
@@ -0,0 +1,127 @@
+From 2b90e7ace79774a3540ce569e000388f8d22c9e0 Mon Sep 17 00:00:00 2001
+From: Peter Jones <pjones@redhat.com>
+Date: Wed, 26 Feb 2025 15:18:39 -0500
+Subject: efi: Don't map the entire mokvar table to determine its size
+
+From: Peter Jones <pjones@redhat.com>
+
+commit 2b90e7ace79774a3540ce569e000388f8d22c9e0 upstream.
+
+Currently, when validating the mokvar table, we (re)map the entire table
+on each iteration of the loop, adding space as we discover new entries.
+If the table grows over a certain size, this fails due to limitations of
+early_memmap(), and we get a failure and traceback:
+
+  ------------[ cut here ]------------
+  WARNING: CPU: 0 PID: 0 at mm/early_ioremap.c:139 __early_ioremap+0xef/0x220
+  ...
+  Call Trace:
+   <TASK>
+   ? __early_ioremap+0xef/0x220
+   ? __warn.cold+0x93/0xfa
+   ? __early_ioremap+0xef/0x220
+   ? report_bug+0xff/0x140
+   ? early_fixup_exception+0x5d/0xb0
+   ? early_idt_handler_common+0x2f/0x3a
+   ? __early_ioremap+0xef/0x220
+   ? efi_mokvar_table_init+0xce/0x1d0
+   ? setup_arch+0x864/0xc10
+   ? start_kernel+0x6b/0xa10
+   ? x86_64_start_reservations+0x24/0x30
+   ? x86_64_start_kernel+0xed/0xf0
+   ? common_startup_64+0x13e/0x141
+   </TASK>
+  ---[ end trace 0000000000000000 ]---
+  mokvar: Failed to map EFI MOKvar config table pa=0x7c4c3000, size=265187.
+
+Mapping the entire structure isn't actually necessary, as we don't ever
+need more than one entry header mapped at once.
+
+Changes efi_mokvar_table_init() to only map each entry header, not the
+entire table, when determining the table size.  Since we're not mapping
+any data past the variable name, it also changes the code to enforce
+that each variable name is NUL terminated, rather than attempting to
+verify it in place.
+
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Peter Jones <pjones@redhat.com>
+Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/firmware/efi/mokvar-table.c |   42 +++++++++++-------------------------
+ 1 file changed, 13 insertions(+), 29 deletions(-)
+
+--- a/drivers/firmware/efi/mokvar-table.c
++++ b/drivers/firmware/efi/mokvar-table.c
+@@ -103,9 +103,7 @@ void __init efi_mokvar_table_init(void)
+       void *va = NULL;
+       unsigned long cur_offset = 0;
+       unsigned long offset_limit;
+-      unsigned long map_size = 0;
+       unsigned long map_size_needed = 0;
+-      unsigned long size;
+       struct efi_mokvar_table_entry *mokvar_entry;
+       int err;
+ 
+@@ -134,48 +132,34 @@ void __init efi_mokvar_table_init(void)
+        */
+       err = -EINVAL;
+       while (cur_offset + sizeof(*mokvar_entry) <= offset_limit) {
+-              mokvar_entry = va + cur_offset;
+-              map_size_needed = cur_offset + sizeof(*mokvar_entry);
+-              if (map_size_needed > map_size) {
+-                      if (va)
+-                              early_memunmap(va, map_size);
+-                      /*
+-                       * Map a little more than the fixed size entry
+-                       * header, anticipating some data. It's safe to
+-                       * do so as long as we stay within current memory
+-                       * descriptor.
+-                       */
+-                      map_size = min(map_size_needed + 2*EFI_PAGE_SIZE,
+-                                     offset_limit);
+-                      va = early_memremap(efi.mokvar_table, map_size);
+-                      if (!va) {
+-                              pr_err("Failed to map EFI MOKvar config table pa=0x%lx, size=%lu.\n",
+-                                     efi.mokvar_table, map_size);
+-                              return;
+-                      }
+-                      mokvar_entry = va + cur_offset;
++              if (va)
++                      early_memunmap(va, sizeof(*mokvar_entry));
++              va = early_memremap(efi.mokvar_table + cur_offset, sizeof(*mokvar_entry));
++              if (!va) {
++                      pr_err("Failed to map EFI MOKvar config table pa=0x%lx, size=%zu.\n",
++                             efi.mokvar_table + cur_offset, sizeof(*mokvar_entry));
++                      return;
+               }
++              mokvar_entry = va;
+ 
+               /* Check for last sentinel entry */
+               if (mokvar_entry->name[0] == '\0') {
+                       if (mokvar_entry->data_size != 0)
+                               break;
+                       err = 0;
++                      map_size_needed = cur_offset + sizeof(*mokvar_entry);
+                       break;
+               }
+ 
+-              /* Sanity check that the name is null terminated */
+-              size = strnlen(mokvar_entry->name,
+-                             sizeof(mokvar_entry->name));
+-              if (size >= sizeof(mokvar_entry->name))
+-                      break;
++              /* Enforce that the name is NUL terminated */
++              mokvar_entry->name[sizeof(mokvar_entry->name) - 1] = '\0';
+ 
+               /* Advance to the next entry */
+-              cur_offset = map_size_needed + mokvar_entry->data_size;
++              cur_offset += sizeof(*mokvar_entry) + mokvar_entry->data_size;
+       }
+ 
+       if (va)
+-              early_memunmap(va, map_size);
++              early_memunmap(va, sizeof(*mokvar_entry));
+       if (err) {
+               pr_err("EFI MOKvar config table is not valid\n");
+               return;

diff --git a/queue-6.13/series b/queue-6.13/series
index 65f24eb39c1bc00c8fc27932a6d213642f2e7103..2c13b67c8dee9a9f9e0fa2d4896f9d2fc10fe348 100644 (file)
--- a/queue-6.13/series
+++ b/queue-6.13/series
@@ -146,3 +146,4 @@ riscv-signal-fix-signal-frame-size.patch
 riscv-cacheinfo-use-of_property_present-for-non-boolean-properties.patch
 riscv-signal-fix-signal_minsigstksz.patch
 riscv-cpufeature-use-bitmap_equal-instead-of-memcmp.patch
+efi-don-t-map-the-entire-mokvar-table-to-determine-its-size.patch