linux-kernel - [tip:efi/core] efi/memattr: Don't bail on zero VA if it equals the region's PA

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <tip-5de0fef0230f3c8d75cff450a71740a7bf2db866@git.kernel.org>
Date:   Mon, 4 Feb 2019 00:42:59 -0800
From:   tip-bot for Ard Biesheuvel <tipbot@...or.com>
To:     linux-tip-commits@...r.kernel.org
Cc:     jhugo@...eaurora.org, bjorn.andersson@...aro.org, agraf@...e.de,
        matt@...eblueprint.co.uk, pjones@...hat.com, lee.jones@...aro.org,
        hpa@...or.com, xypron.glpk@....de, leif.lindholm@...aro.org,
        sai.praneeth.prakhya@...el.com, bp@...en8.de,
        torvalds@...ux-foundation.org, peterz@...radead.org,
        mingo@...nel.org, tglx@...utronix.de, ard.biesheuvel@...aro.org,
        takahiro.akashi@...aro.org, linux-kernel@...r.kernel.org
Subject: [tip:efi/core] efi/memattr: Don't bail on zero VA if it equals the
 region's PA

Commit-ID:  5de0fef0230f3c8d75cff450a71740a7bf2db866
Gitweb:     https://git.kernel.org/tip/5de0fef0230f3c8d75cff450a71740a7bf2db866
Author:     Ard Biesheuvel <ard.biesheuvel@...aro.org>
AuthorDate: Sat, 2 Feb 2019 10:41:12 +0100
Committer:  Ingo Molnar <mingo@...nel.org>
CommitDate: Mon, 4 Feb 2019 08:26:34 +0100

efi/memattr: Don't bail on zero VA if it equals the region's PA

The EFI memory attributes code cross-references the EFI memory map with
the more granular EFI memory attributes table to ensure that they are in
sync before applying the strict permissions to the regions it describes.

Since we always install virtual mappings for the EFI runtime regions to
which these strict permissions apply, we currently perform a sanity check
on the EFI memory descriptor, and ensure that the EFI_MEMORY_RUNTIME bit
is set, and that the virtual address has been assigned.

However, in cases where a runtime region exists at physical address 0x0,
and the virtual mapping equals the physical mapping, e.g., when running
in mixed mode on x86, we encounter a memory descriptor with the runtime
attribute and virtual address 0x0, and incorrectly draw the conclusion
that a runtime region exists for which no virtual mapping was installed,
and give up altogether. The consequence of this is that firmware mappings
retain their read-write-execute permissions, making the system more
vulnerable to attacks.

So let's only bail if the virtual address of 0x0 has been assigned to a
physical region that does not reside at address 0x0.

Signed-off-by: Ard Biesheuvel <ard.biesheuvel@...aro.org>
Acked-by: Sai Praneeth Prakhya <sai.praneeth.prakhya@...el.com>
Cc: AKASHI Takahiro <takahiro.akashi@...aro.org>
Cc: Alexander Graf <agraf@...e.de>
Cc: Bjorn Andersson <bjorn.andersson@...aro.org>
Cc: Borislav Petkov <bp@...en8.de>
Cc: Heinrich Schuchardt <xypron.glpk@....de>
Cc: Jeffrey Hugo <jhugo@...eaurora.org>
Cc: Lee Jones <lee.jones@...aro.org>
Cc: Leif Lindholm <leif.lindholm@...aro.org>
Cc: Linus Torvalds <torvalds@...ux-foundation.org>
Cc: Matt Fleming <matt@...eblueprint.co.uk>
Cc: Peter Jones <pjones@...hat.com>
Cc: Peter Zijlstra <peterz@...radead.org>
Cc: Thomas Gleixner <tglx@...utronix.de>
Cc: linux-efi@...r.kernel.org
Fixes: 10f0d2f577053 ("efi: Implement generic support for the Memory ...")
Link: http://lkml.kernel.org/r/20190202094119.13230-4-ard.biesheuvel@linaro.org
Signed-off-by: Ingo Molnar <mingo@...nel.org>
---
 drivers/firmware/efi/memattr.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/firmware/efi/memattr.c b/drivers/firmware/efi/memattr.c
index 8986757eafaf..aac972b056d9 100644
--- a/drivers/firmware/efi/memattr.c
+++ b/drivers/firmware/efi/memattr.c
@@ -94,7 +94,7 @@ static bool entry_is_valid(const efi_memory_desc_t *in, efi_memory_desc_t *out)

 		if (!(md->attribute & EFI_MEMORY_RUNTIME))
 			continue;
-		if (md->virt_addr == 0) {
+		if (md->virt_addr == 0 && md->phys_addr != 0) {
 			/* no virtual mapping has been installed by the stub */
 			break;
 		}