linux-hardening - [PATCH] efi/arm: Disable LPAE PAN when calling EFI runtime services

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20240610122437.2358778-2-ardb+git@google.com>
Date: Mon, 10 Jun 2024 14:24:38 +0200
From: Ard Biesheuvel <ardb+git@...gle.com>
To: linux-efi@...r.kernel.org
Cc: linux-arm-kernel@...ts.infradead.org, linux-hardening@...r.kernel.org, 
	linux@...linux.org.uk, Ard Biesheuvel <ardb@...nel.org>, Kees Cook <keescook@...omium.org>, 
	Linus Walleij <linus.walleij@...aro.org>
Subject: [PATCH] efi/arm: Disable LPAE PAN when calling EFI runtime services

From: Ard Biesheuvel <ardb@...nel.org>

EFI runtime services are remapped into the lower 1 GiB of virtual
address space at boot, so they are guaranteed to be able to co-exist
with the kernel virtual mappings without the need to allocate space for
them in the kernel's vmalloc region, which is rather small.

This means those mappings are covered by TTBR0 when LPAE PAN is enabled,
and so 'user' access must be enabled while such calls are in progress.

To avoid the need to refactor the code that is shared between ARM, arm64
and other EFI architectures, fold this into efi_set_pgd(). Given that
EFI runtime services are serialized and not pre-emptible, storing the
flags into a global variable is reasonable here - efi_set_pgd() calls
will always occur in pairs on a single CPU.

Cc: Kees Cook <keescook@...omium.org>
Cc: Linus Walleij <linus.walleij@...aro.org>
Signed-off-by: Ard Biesheuvel <ardb@...nel.org>
---
 arch/arm/include/asm/efi.h | 15 +++++++++++++++
 arch/arm/kernel/efi.c      |  4 ++++
 2 files changed, 19 insertions(+)

diff --git a/arch/arm/include/asm/efi.h b/arch/arm/include/asm/efi.h
index 78282ced5038..773fb072c040 100644
--- a/arch/arm/include/asm/efi.h
+++ b/arch/arm/include/asm/efi.h
@@ -14,6 +14,7 @@
 #include <asm/mach/map.h>
 #include <asm/mmu_context.h>
 #include <asm/ptrace.h>
+#include <asm/uaccess.h>
 
 #ifdef CONFIG_EFI
 void efi_init(void);
@@ -32,6 +33,20 @@ int efi_set_mapping_permissions(struct mm_struct *mm, efi_memory_desc_t *md, boo
 static inline void efi_set_pgd(struct mm_struct *mm)
 {
 	check_and_switch_context(mm, NULL);
+
+	if (IS_ENABLED(CONFIG_ARM_TTBR0_PAN)) {
+		extern unsigned int efi_arm_ttbr0_pan_flags;
+
+		/*
+		 * EFI runtime services are mapped in the lower TTBR0 region,
+		 * so TTBR0 based PAN should be disabled while making a EFI
+		 * runtime service call.
+		 */
+		if (mm != current->active_mm)
+			efi_arm_ttbr0_pan_flags = uaccess_save_and_enable();
+		else
+			uaccess_restore(efi_arm_ttbr0_pan_flags);
+	}
 }
 
 void efi_virtmap_load(void);
diff --git a/arch/arm/kernel/efi.c b/arch/arm/kernel/efi.c
index 6f9ec7d28a71..6864338073e6 100644
--- a/arch/arm/kernel/efi.c
+++ b/arch/arm/kernel/efi.c
@@ -11,6 +11,10 @@
 #include <asm/mach/map.h>
 #include <asm/mmu_context.h>
 
+#ifdef CONFIG_ARM_TTBR0_PAN
+unsigned int efi_arm_ttbr0_pan_flags;
+#endif
+
 static int __init set_permissions(pte_t *ptep, unsigned long addr, void *data)
 {
 	efi_memory_desc_t *md = data;
-- 
2.45.2.505.gda0bf45e8d-goog