efi/x86: Map the entire EFI vendor string before copying it

BugLink: https://bugs.launchpad.net/bugs/1867837
[ Upstream commit ffc2760bcf2dba0dbef74013ed73eea8310cc52c ]

Fix a couple of issues with the way we map and copy the vendor string:
- we map only 2 bytes, which usually works since you get at least a
  page, but if the vendor string happens to cross a page boundary,
  a crash will result
- only call early_memunmap() if early_memremap() succeeded, or we will
  call it with a NULL address which it doesn't like,
- while at it, switch to early_memremap_ro(), and array indexing rather
  than pointer dereferencing to read the CHAR16 characters.

Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
Cc: Andy Lutomirski <luto@kernel.org>
Cc: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Cc: Arvind Sankar <nivedita@alum.mit.edu>
Cc: Matthew Garrett <mjg59@google.com>
Cc: linux-efi@vger.kernel.org
Fixes: 5b83683f32b1 ("x86: EFI runtime service support")
Link: https://lkml.kernel.org/r/20200103113953.9571-5-ardb@kernel.org
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
Signed-off-by: Khalid Elmously <khalid.elmously@canonical.com>

diff --git a/arch/x86/platform/efi/efi.c b/arch/x86/platform/efi/efi.c
index 335a62e74a2e9ad8d1751bd1aef1bc556d2ce172..5b0275310070e7dae8a9168e4e06977dbb305108 100644 (file)
--- a/arch/x86/platform/efi/efi.c
+++ b/arch/x86/platform/efi/efi.c
@@ -480,7 +480,6 @@ void __init efi_init(void)
        efi_char16_t *c16;
        char vendor[100] = "unknown";
        int i = 0;
-       void *tmp;
 
 #ifdef CONFIG_X86_32
        if (boot_params.efi_info.efi_systab_hi ||
@@ -505,14 +504,16 @@ void __init efi_init(void)
        /*
         * Show what we know for posterity
         */
-       c16 = tmp = early_memremap(efi.systab->fw_vendor, 2);
+       c16 = early_memremap_ro(efi.systab->fw_vendor,
+                               sizeof(vendor) * sizeof(efi_char16_t));
        if (c16) {
-               for (i = 0; i < sizeof(vendor) - 1 && *c16; ++i)
-                       vendor[i] = *c16++;
+               for (i = 0; i < sizeof(vendor) - 1 && c16[i]; ++i)
+                       vendor[i] = c16[i];
                vendor[i] = '\0';
-       } else
+               early_memunmap(c16, sizeof(vendor) * sizeof(efi_char16_t));
+       } else {
                pr_err("Could not map the firmware vendor!\n");
-       early_memunmap(tmp, 2);
+       }
 
        pr_info("EFI v%u.%.02u by %s\n",
                efi.systab->hdr.revision >> 16,