linux-kernel - [tip:efi/core] x86/efi/bgrt: Don't ignore the BGRT if the 'valid' bit is 0

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Wed, 3 Feb 2016 03:33:35 -0800
From:	"tip-bot for Môshe van der Sterre" 
	<tipbot@...or.com>
To:	linux-tip-commits@...r.kernel.org
Cc:	linux-kernel@...r.kernel.org, josh@...htriplett.org, me@...he.nl,
	hpa@...or.com, mingo@...nel.org, matt@...eblueprint.co.uk,
	tglx@...utronix.de
Subject: [tip:efi/core] x86/efi/bgrt: Don't ignore the BGRT if the 'valid'
  bit is 0

Commit-ID:  66dbe99cfe30e113d2e571e68b9b6a1a8985a157
Gitweb:     http://git.kernel.org/tip/66dbe99cfe30e113d2e571e68b9b6a1a8985a157
Author:     Môshe van der Sterre <me@...he.nl>
AuthorDate: Mon, 1 Feb 2016 22:07:03 +0000
Committer:  Ingo Molnar <mingo@...nel.org>
CommitDate: Wed, 3 Feb 2016 11:41:19 +0100

x86/efi/bgrt: Don't ignore the BGRT if the 'valid' bit is 0

Unintuitively, the BGRT graphic is apparently meant to be usable
if the valid bit in not set. The valid bit only conveys
uncertainty about the validity in relation to the screen state.

Windows 10 actually uses the BGRT image for its boot screen even
if not 'valid', for example when the user triggered the boot
menu. Because it is unclear if all firmwares will provide a
usable graphic in this case, we now look at the BMP magic number
as an additional check.

Reviewed-by: Josh Triplett <josh@...htriplett.org>
Signed-off-by: Môshe van der Sterre <me@...he.nl>
Signed-off-by: Matt Fleming <matt@...eblueprint.co.uk>
Cc: =?UTF-8?q?M=C3=B4she=20van=20der=20Sterre?= <me@...he.nl>
Link: http://lkml.kernel.org/r/1454364428-494-10-git-send-email-matt@codeblueprint.co.uk
Signed-off-by: Ingo Molnar <mingo@...nel.org>
---
 arch/x86/platform/efi/efi-bgrt.c | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/arch/x86/platform/efi/efi-bgrt.c b/arch/x86/platform/efi/efi-bgrt.c
index b097066..a243381 100644
--- a/arch/x86/platform/efi/efi-bgrt.c
+++ b/arch/x86/platform/efi/efi-bgrt.c
@@ -57,11 +57,6 @@ void __init efi_bgrt_init(void)
 		       bgrt_tab->status);
 		return;
 	}
-	if (bgrt_tab->status != 1) {
-		pr_debug("Ignoring BGRT: invalid status %u (expected 1)\n",
-			 bgrt_tab->status);
-		return;
-	}
 	if (bgrt_tab->image_type != 0) {
 		pr_err("Ignoring BGRT: invalid image type %u (expected 0)\n",
 		       bgrt_tab->image_type);
@@ -80,6 +75,11 @@ void __init efi_bgrt_init(void)
 
 	memcpy(&bmp_header, image, sizeof(bmp_header));
 	memunmap(image);
+	if (bmp_header.id != 0x4d42) {
+		pr_err("Ignoring BGRT: Incorrect BMP magic number 0x%x (expected 0x4d42)\n",
+			bmp_header.id);
+		return;
+	}
 	bgrt_image_size = bmp_header.size;
 
 	bgrt_image = kmalloc(bgrt_image_size, GFP_KERNEL | __GFP_NOWARN);