Skip to content
  • Borislav Petkov's avatar
    x86/microcode: Fix again accessing initrd after having been freed · 1d080f09
    Borislav Petkov authored
    Commit 24c25032 ("x86/microcode: Do not access the initrd after it has
    been freed") fixed attempts to access initrd from the microcode loader
    after it has been freed. However, a similar KASAN warning was reported
    (stack trace edited):
    
      smpboot: Booting Node 0 Processor 1 APIC 0x11
      ==================================================================
      BUG: KASAN: use-after-free in find_cpio_data+0x9b5/0xa50
      Read of size 1 at addr ffff880035ffd000 by task swapper/1/0
    
      CPU: 1 PID: 0 Comm: swapper/1 Not tainted 4.14.8-slack #7
      Hardware name: System manufacturer System Product Name/A88X-PLUS, BIOS 3003 03/10/2016
      Call Trace:
       dump_stack
       print_address_description
       kasan_report
       ? find_cpio_data
       __asan_report_load1_noabort
       find_cpio_data
       find_microcode_in_initrd
       __load_ucode_amd
       load_ucode_amd_ap
          load_ucode_ap
    
    After some investigation, it turned out that a merge was done using the
    wrong side to resolve, leading to picking up the previous state, before
    the 24c25032 fix. Therefore the Fixes tag below contains a merge
    commit.
    
    Revert the mismerge by catching the save_microcode_in_initrd_amd()
    retval and thus letting the function exit with the last return statement
    so that initrd_gone can be set to true.
    
    Fixes: f26483ea
    
     ("Merge branch 'x86/urgent' into x86/microcode, to resolve conflicts")
    Reported-by: default avatar <higuita@gmx.net>
    Signed-off-by: default avatarBorislav Petkov <bp@suse.de>
    Signed-off-by: default avatarThomas Gleixner <tglx@linutronix.de>
    Cc: stable@vger.kernel.org
    Link: https://bugzilla.kernel.org/show_bug.cgi?id=198295
    Link: https://lkml.kernel.org/r/20180123104133.918-2-bp@alien8.de
    1d080f09