github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-09-23 22:14:03 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

efi/runtime-wrappers: bound the wait for EFI runtime service calls

Browse Source 
When an EFI runtime service hangs in firmware, the efi_rts_wq worker is
stuck inside the call and cannot be cancelled. __efi_queue_work() then
waits on the completion forever while holding efi_runtime_lock, so every
later EFI caller is wedged until reboot; the only symptom is a "workqueue
lockup" and tasks piling up on the semaphore.

Replace wait_for_completion() with wait_for_completion_timeout() bounded
by EFI_RTS_TIMEOUT (120 seconds). On timeout, clear EFI_RUNTIME_SERVICES
and return EFI_ABORTED so later callers fail fast at the entry check
instead of each paying another 120 seconds. The wedged worker is
intentionally leaked and keeps ownership of efi_rts_work.

A worker that only starts running after the timeout would otherwise
dereference efi_rts_work.args, now pointing into the caller's freed stack
frame, and hand stale pointers to firmware. Park it with
efi_rts_park_worker() at the entry of efi_call_rts() when runtime
services are already disabled, before it touches args or enters firmware.

Known limitation: a worker already inside firmware when the timeout fires
still holds efi_rts_args pointing into the caller's stack frame; if
firmware unblocks afterwards and writes the output buffers, they land in
reused memory. Firmware hung this long rarely recovers; a follow-up could
bounce the buffers through kmalloc.

Signed-off-by: Breno Leitao <leitao@debian.org>
Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
This commit is contained in:
Breno Leitao 2026-06-16 05:09:38 -07:00 committed by Ard Biesheuvel
parent 7f64cb373f
commit 60618389de
1 changed files with 18 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
drivers/firmware/efi/runtime-wrappers.c
View File

@ -118,6 +118,14 @@ union efi_rts_args {
struct efi_runtime_work efi_rts_work;
/*
* Upper bound on how long we wait for a single EFI runtime service
* call to finish before declaring firmware wedged. Chosen to be longer
* than any plausible legitimate call (including UpdateCapsule on slow
* SPI-NOR) while still bounding userspace wait time.
*/
#define EFI_RTS_TIMEOUT (120 * HZ)
/*
* efi_queue_work: Queue EFI runtime service call and wait for completion
* @_rts: EFI runtime service function identifier
@ -234,6 +242,9 @@ static void __nocfi efi_call_rts(struct work_struct *work)
efi_status_t status = EFI_NOT_FOUND;
unsigned long flags;
if (!efi_enabled(EFI_RUNTIME_SERVICES))
efi_rts_park_worker();
efi_runtime_lock_owner = current;
arch_efi_call_virt_setup();
@ -355,7 +366,13 @@ static efi_status_t __efi_queue_work(enum efi_rts_ids id,
goto exit;
}
wait_for_completion(&efi_rts_work.efi_rts_comp);
if (!wait_for_completion_timeout(&efi_rts_work.efi_rts_comp,
EFI_RTS_TIMEOUT)) {
pr_err("EFI runtime service %d wedged in firmware; disabling EFI runtime services\n",
id);
clear_bit(EFI_RUNTIME_SERVICES, &efi.flags);
return EFI_ABORTED;
}
WARN_ON_ONCE(efi_rts_work.status == EFI_ABORTED);
exit: