[PATCH] ACPI: sysfs: Map only the requested range in acpi_data_show()

[PATCH] ACPI: sysfs: Map only the requested range in acpi_data_show()

[Jamie Nguyen]

acpi_data_show() maps the whole data region on every read(), although
it copies at most count bytes and sysfs passes at most PAGE_SIZE bytes
per call. acpi_os_unmap_iomem() defers the iounmap until after an RCU
grace period, so a process reading one of these files in a loop keeps
many full-size mappings in flight.

Map only the range being read. acpi_os_map_iomem() rounds the mapping
to page boundaries, so each mapping is now at most two pages, whatever
the size of the region.

A malformed table can describe a region that wraps around the end of
the physical address space. acpi_os_map_iomem() doesn't check for that,
and its lookup of existing mappings then matches an unrelated mapping,
with or without this change. Fail reads of such a region before mapping
anything.

Assisted-by: LLM
Signed-off-by: Jamie Nguyen <jamien@nvidia.com>
---
As discussed on the BDAT v2 thread:
https://lore.kernel.org/r/CAJZ5v0ixQ_5jmrfm4mz50tZtCEq6nJt1b2eMoBdhr0f3AY+k7w@mail.gmail.com

This doesn't depend on that series and applies on its own.

Tested on an arm64 server with 4K and 64K pages, with the BDAT v2
series applied:

- The BERT and BDAT data files match /dev/mem when read whole, byte by
  byte, page by page, and across page boundaries.
- Each read maps at most two pages. With 4K pages, looping full reads
  of the 90754-byte BDAT file kept at most 167 MiB of vmalloc space
  mapped (1740 MiB before), and looping 1-byte reads at most 355 MiB
  (3090 MiB before).
- Malformed BERT tables loaded via initrd table upgrade, with regions
  that wrap around the end of the physical address space, fail every
  read with -EINVAL.

 drivers/acpi/sysfs.c | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/drivers/acpi/sysfs.c b/drivers/acpi/sysfs.c
index dd4a99f09efea65..138009659a7b55f 100644
--- a/drivers/acpi/sysfs.c
+++ b/drivers/acpi/sysfs.c
@@ -419,6 +419,7 @@ static ssize_t acpi_data_show(struct file *filp, struct kobject *kobj,
 	struct acpi_data_attr *data_attr;
 	void __iomem *base;
 	ssize_t size;
+	u64 end;
 
 	data_attr = container_of(bin_attr, struct acpi_data_attr, attr);
 	size = data_attr->attr.size;
@@ -432,13 +433,17 @@ static ssize_t acpi_data_show(struct file *filp, struct kobject *kobj,
 	if (count > size - offset)
 		count = size - offset;
 
-	base = acpi_os_map_iomem(data_attr->addr, size);
+	/* acpi_os_map_iomem() can't handle a range that wraps around */
+	if (check_add_overflow(data_attr->addr, size, &end))
+		return -EINVAL;
+
+	base = acpi_os_map_iomem(data_attr->addr + offset, count);
 	if (!base)
 		return -ENOMEM;
 
-	memcpy_fromio(buf, base + offset, count);
+	memcpy_fromio(buf, base, count);
 
-	acpi_os_unmap_iomem(base, size);
+	acpi_os_unmap_iomem(base, count);
 
 	return count;
 }
-- 
2.43.0