Skip to content

Commit

Permalink
firmware: qcom: uefisecapp: fix efivars registration race
Browse files Browse the repository at this point in the history
Since the conversion to using the TZ allocator, the efivars service is
registered before the memory pool has been allocated, something which
can lead to a NULL-pointer dereference in case of a racing EFI variable
access.

Make sure that all resources have been set up before registering the
efivars.

Fixes: 6612103 ("firmware: qcom: qseecom: convert to using the TZ allocator")
Cc: stable@vger.kernel.org	# 6.11
Cc: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
Signed-off-by: Johan Hovold <johan+linaro@kernel.org>
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Reviewed-by: Maximilian Luz <luzmaximilian@gmail.com>
Reviewed-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
Link: https://lore.kernel.org/r/20250120151000.13870-1-johan+linaro@kernel.org
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
  • Loading branch information
Johan Hovold authored and Bjorn Andersson committed Feb 8, 2025
1 parent 7f048b2 commit da8d493
Showing 1 changed file with 9 additions and 9 deletions.
18 changes: 9 additions & 9 deletions drivers/firmware/qcom/qcom_qseecom_uefisecapp.c
Original file line number Diff line number Diff line change
Expand Up @@ -814,15 +814,6 @@ static int qcom_uefisecapp_probe(struct auxiliary_device *aux_dev,

qcuefi->client = container_of(aux_dev, struct qseecom_client, aux_dev);

auxiliary_set_drvdata(aux_dev, qcuefi);
status = qcuefi_set_reference(qcuefi);
if (status)
return status;

status = efivars_register(&qcuefi->efivars, &qcom_efivar_ops);
if (status)
qcuefi_set_reference(NULL);

memset(&pool_config, 0, sizeof(pool_config));
pool_config.initial_size = SZ_4K;
pool_config.policy = QCOM_TZMEM_POLICY_MULTIPLIER;
Expand All @@ -833,6 +824,15 @@ static int qcom_uefisecapp_probe(struct auxiliary_device *aux_dev,
if (IS_ERR(qcuefi->mempool))
return PTR_ERR(qcuefi->mempool);

auxiliary_set_drvdata(aux_dev, qcuefi);
status = qcuefi_set_reference(qcuefi);
if (status)
return status;

status = efivars_register(&qcuefi->efivars, &qcom_efivar_ops);
if (status)
qcuefi_set_reference(NULL);

return status;
}

Expand Down

0 comments on commit da8d493

Please sign in to comment.