linux-kernel - [tip:x86/efi] x86, efi: Fix . text section overlapping image header for EFI

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Date:	Mon, 26 Mar 2012 15:20:29 -0700
From:	tip-bot for Matt Fleming <matt.fleming@...el.com>
To:	linux-tip-commits@...r.kernel.org
Cc:	linux-kernel@...r.kernel.org, hpa@...or.com, mingo@...nel.org,
	jordan.l.justen@...el.com, tglx@...utronix.de, hpa@...ux.intel.com,
	matt.fleming@...el.com
Subject: [tip:x86/efi] x86, efi: Fix .
 text section overlapping image header for EFI_STUB

Commit-ID:  e31be363df3092821bf179cf4baa076f501b8ae6
Gitweb:     http://git.kernel.org/tip/e31be363df3092821bf179cf4baa076f501b8ae6
Author:     Matt Fleming <matt.fleming@...el.com>
AuthorDate: Fri, 23 Mar 2012 09:35:05 -0700
Committer:  H. Peter Anvin <hpa@...ux.intel.com>
CommitDate: Mon, 26 Mar 2012 13:10:01 -0700

x86, efi: Fix .text section overlapping image header for EFI_STUB

This change modifes the PE .text section to start after
the first sector of the kernel image.

The header may be modified by the UEFI secure boot signing,
so it is not appropriate for it to be included in one of the
image sections. Since the sections are part of the secure
boot hash, this modification to the .text section contents
would invalidate the secure boot signed hash.

Note: UEFI secure boot does hash the image header, but
fields that are changed by the signing process are excluded
from the hash calculation.  This exclusion process is only
handled for the image header, and not image sections.

Luckily, we can still easily boot without the first sector
by initializing a few fields in arch/x86/boot/compressed/eboot.c.

Signed-off-by: Matt Fleming <matt.fleming@...el.com>
Link: http://lkml.kernel.org/r/1332520506-6472-3-git-send-email-jordan.l.justen@intel.com
[jordan.l.justen@...el.com: set .text vma & file offset]
Signed-off-by: Jordan Justen <jordan.l.justen@...el.com>
Signed-off-by: H. Peter Anvin <hpa@...ux.intel.com>
---
 arch/x86/boot/compressed/eboot.c |   14 +++++++++++---
 arch/x86/boot/header.S           |    2 +-
 arch/x86/boot/tools/build.c      |   25 ++++++++++++++++++++++---
 3 files changed, 34 insertions(+), 7 deletions(-)

diff --git a/arch/x86/boot/compressed/eboot.c b/arch/x86/boot/compressed/eboot.c
index fec216f..01cbb87 100644
--- a/arch/x86/boot/compressed/eboot.c
+++ b/arch/x86/boot/compressed/eboot.c
@@ -904,11 +904,19 @@ struct boot_params *efi_main(void *handle, efi_system_table_t *_table)
 
 	memset(boot_params, 0x0, 0x4000);
 
-	/* Copy first two sectors to boot_params */
-	memcpy(boot_params, image->image_base, 1024);
-
 	hdr = &boot_params->hdr;
 
+	/* Copy the second sector to boot_params */
+	memcpy(&hdr->jump, image->image_base + 512, 512);
+
+	/*
+	 * Fill out some of the header fields ourselves because the
+	 * EFI firmware loader doesn't load the first sector.
+	 */
+	hdr->root_flags = 1;
+	hdr->vid_mode = 0xffff;
+	hdr->boot_flag = 0xAA55;
+
 	/*
 	 * The EFI firmware loader could have placed the kernel image
 	 * anywhere in memory, but the kernel has various restrictions
diff --git a/arch/x86/boot/header.S b/arch/x86/boot/header.S
index 4e9124b..4ceb56e 100644
--- a/arch/x86/boot/header.S
+++ b/arch/x86/boot/header.S
@@ -147,7 +147,7 @@ optional_header:
 	# Filled in by build.c
 	.long	0x0000				# AddressOfEntryPoint
 
-	.long	0x0000				# BaseOfCode
+	.long	0x0200				# BaseOfCode
 #ifdef CONFIG_X86_32
 	.long	0				# data
 #endif
diff --git a/arch/x86/boot/tools/build.c b/arch/x86/boot/tools/build.c
index 4e9bd6b..2aeab3d 100644
--- a/arch/x86/boot/tools/build.c
+++ b/arch/x86/boot/tools/build.c
@@ -202,12 +202,19 @@ int main(int argc, char ** argv)
 
 	pe_header = *(unsigned int *)&buf[0x3c];
 
-	/* Size of code */
-	*(unsigned int *)&buf[pe_header + 0x1c] = file_sz;
-
 	/* Size of image */
 	*(unsigned int *)&buf[pe_header + 0x50] = file_sz;
 
+	/*
+	 * Subtract the size of the first section (512 bytes) which
+	 * includes the header and .reloc section. The remaining size
+	 * is that of the .text section.
+	 */
+	file_sz -= 512;
+
+	/* Size of code */
+	*(unsigned int *)&buf[pe_header + 0x1c] = file_sz;
+
 #ifdef CONFIG_X86_32
 	/* Address of entry point */
 	*(unsigned int *)&buf[pe_header + 0x28] = i;
@@ -215,8 +222,14 @@ int main(int argc, char ** argv)
 	/* .text size */
 	*(unsigned int *)&buf[pe_header + 0xb0] = file_sz;
 
+	/* .text vma */
+	*(unsigned int *)&buf[pe_header + 0xb4] = 0x200;
+
 	/* .text size of initialised data */
 	*(unsigned int *)&buf[pe_header + 0xb8] = file_sz;
+
+	/* .text file offset */
+	*(unsigned int *)&buf[pe_header + 0xbc] = 0x200;
 #else
 	/*
 	 * Address of entry point. startup_32 is at the beginning and
@@ -228,8 +241,14 @@ int main(int argc, char ** argv)
 	/* .text size */
 	*(unsigned int *)&buf[pe_header + 0xc0] = file_sz;
 
+	/* .text vma */
+	*(unsigned int *)&buf[pe_header + 0xc4] = 0x200;
+
 	/* .text size of initialised data */
 	*(unsigned int *)&buf[pe_header + 0xc8] = file_sz;
+
+	/* .text file offset */
+	*(unsigned int *)&buf[pe_header + 0xcc] = 0x200;
 #endif /* CONFIG_X86_32 */
 #endif /* CONFIG_EFI_STUB */
 
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/