linux-kernel - Re: AMD microcode loading broken on 32 bit

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20140128213030.GM815@pd.tnic>
Date:	Tue, 28 Jan 2014 22:30:30 +0100
From:	Borislav Petkov <bp@...en8.de>
To:	Boris Ostrovsky <boris.ostrovsky@...cle.com>
Cc:	"H. Peter Anvin" <hpa@...or.com>, linux-kernel@...r.kernel.org,
	Ingo Molnar <mingo@...nel.org>
Subject: Re: AMD microcode loading broken on 32 bit

On Tue, Jan 28, 2014 at 04:05:20PM -0500, Boris Ostrovsky wrote:
> Yes. This was a bug in our build environment. It is fixed now but I
> put this bug back when I was testing your patch.

Right, that was the deal. Oh well, we'd need to verify the container
too, I guess:

---
diff --git a/arch/x86/kernel/cpu/microcode/amd_early.c b/arch/x86/kernel/cpu/microcode/amd_early.c
index 8384c0fa206f..c568b6c9af95 100644
--- a/arch/x86/kernel/cpu/microcode/amd_early.c
+++ b/arch/x86/kernel/cpu/microcode/amd_early.c
@@ -37,10 +37,12 @@ static __initdata char ucode_path[] = "kernel/x86/microcode/AuthenticAMD.bin";
 
 static struct cpio_data __init find_ucode_in_initrd(void)
 {
+	struct cpio_data ret;
 	long offset = 0;
 	char *path;
 	void *start;
 	size_t size;
+	u32 *hdr;
 
 #ifdef CONFIG_X86_32
 	struct boot_params *p;
@@ -59,7 +61,18 @@ static struct cpio_data __init find_ucode_in_initrd(void)
 	size    = boot_params.hdr.ramdisk_size;
 #endif
 
-	return find_cpio_data(path, start, size, &offset);
+	ret = find_cpio_data(path, start, size, &offset);
+
+	/* Verify we didn't get some garbage from the initrd. */
+	hdr = (u32 *)ret.data;
+
+	if (hdr[0] != UCODE_MAGIC ||
+	    hdr[1] != UCODE_EQUIV_CPU_TABLE_TYPE ||
+	    hdr[2] == 0) {
+		ret.data = NULL;
+		ret.size = 0;
+	}
+	return ret;
 }
 
 static size_t compute_container_size(u8 *data, u32 total_size)
@@ -359,7 +372,7 @@ int __init save_microcode_in_initrd_amd(void)
 		pr_info("microcode: updated early to new patch_level=0x%08x\n",
 			ucode_new_rev);
 
-	if (!container)
+	if (!container || !ucode_cpio.data)
 		return -EINVAL;
 
 	eax   = cpuid_eax(0x00000001);
--

-- 
Regards/Gruss,
    Boris.

Sent from a fat crate under my desk. Formatting is fine.
--
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/