Skip to content

Commit da8d493

Browse files
jhovoldandersson
authored andcommitted
firmware: qcom: uefisecapp: fix efivars registration race
Since the conversion to using the TZ allocator, the efivars service is registered before the memory pool has been allocated, something which can lead to a NULL-pointer dereference in case of a racing EFI variable access. Make sure that all resources have been set up before registering the efivars. Fixes: 6612103 ("firmware: qcom: qseecom: convert to using the TZ allocator") Cc: stable@vger.kernel.org # 6.11 Cc: Bartosz Golaszewski <bartosz.golaszewski@linaro.org> Signed-off-by: Johan Hovold <johan+linaro@kernel.org> Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> Reviewed-by: Maximilian Luz <luzmaximilian@gmail.com> Reviewed-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org> Link: https://lore.kernel.org/r/20250120151000.13870-1-johan+linaro@kernel.org Signed-off-by: Bjorn Andersson <andersson@kernel.org>
1 parent 7f048b2 commit da8d493

File tree

1 file changed

+9
-9
lines changed

1 file changed

+9
-9
lines changed

drivers/firmware/qcom/qcom_qseecom_uefisecapp.c

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -814,15 +814,6 @@ static int qcom_uefisecapp_probe(struct auxiliary_device *aux_dev,
814814

815815
qcuefi->client = container_of(aux_dev, struct qseecom_client, aux_dev);
816816

817-
auxiliary_set_drvdata(aux_dev, qcuefi);
818-
status = qcuefi_set_reference(qcuefi);
819-
if (status)
820-
return status;
821-
822-
status = efivars_register(&qcuefi->efivars, &qcom_efivar_ops);
823-
if (status)
824-
qcuefi_set_reference(NULL);
825-
826817
memset(&pool_config, 0, sizeof(pool_config));
827818
pool_config.initial_size = SZ_4K;
828819
pool_config.policy = QCOM_TZMEM_POLICY_MULTIPLIER;
@@ -833,6 +824,15 @@ static int qcom_uefisecapp_probe(struct auxiliary_device *aux_dev,
833824
if (IS_ERR(qcuefi->mempool))
834825
return PTR_ERR(qcuefi->mempool);
835826

827+
auxiliary_set_drvdata(aux_dev, qcuefi);
828+
status = qcuefi_set_reference(qcuefi);
829+
if (status)
830+
return status;
831+
832+
status = efivars_register(&qcuefi->efivars, &qcom_efivar_ops);
833+
if (status)
834+
qcuefi_set_reference(NULL);
835+
836836
return status;
837837
}
838838

0 commit comments

Comments
 (0)