提交 df91c351 编写于 作者: H H. Peter Anvin

Merge tag 'efi-urgent' into x86/urgent

 * Don't leak random kernel memory to EFI variable NVRAM when attempting
   to initiate garbage collection. Also, free the kernel memory when
   we're done with it instead of leaking - Ben Hutchings
Signed-off-by: NH. Peter Anvin <hpa@linux.intel.com>
...@@ -1069,7 +1069,10 @@ efi_status_t efi_query_variable_store(u32 attributes, unsigned long size) ...@@ -1069,7 +1069,10 @@ efi_status_t efi_query_variable_store(u32 attributes, unsigned long size)
* that by attempting to use more space than is available. * that by attempting to use more space than is available.
*/ */
unsigned long dummy_size = remaining_size + 1024; unsigned long dummy_size = remaining_size + 1024;
void *dummy = kmalloc(dummy_size, GFP_ATOMIC); void *dummy = kzalloc(dummy_size, GFP_ATOMIC);
if (!dummy)
return EFI_OUT_OF_RESOURCES;
status = efi.set_variable(efi_dummy_name, &EFI_DUMMY_GUID, status = efi.set_variable(efi_dummy_name, &EFI_DUMMY_GUID,
EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_NON_VOLATILE |
...@@ -1089,6 +1092,8 @@ efi_status_t efi_query_variable_store(u32 attributes, unsigned long size) ...@@ -1089,6 +1092,8 @@ efi_status_t efi_query_variable_store(u32 attributes, unsigned long size)
0, dummy); 0, dummy);
} }
kfree(dummy);
/* /*
* The runtime code may now have triggered a garbage collection * The runtime code may now have triggered a garbage collection
* run, so check the variable info again * run, so check the variable info again
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册