linux-kernel - Re: [PATCH 5.0 30/46] x86/boot/compressed/64: Do not read legacy ROM on EFI system

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CED6E6E5-00E5-4FFD-A8C9-254EA3A5288E@zytor.com>
Date:   Sat, 09 Mar 2019 22:10:19 -0800
From:   hpa@...or.com
To:     Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        linux-kernel@...r.kernel.org
CC:     stable@...r.kernel.org, Pitam Mitra <pitamm@...il.com>,
        "Kirill A. Shutemov" <kirill.shutemov@...ux.intel.com>,
        Thomas Gleixner <tglx@...utronix.de>,
        Bockjoo Kim <bockjoo@...s.ufl.edu>, bp@...en8.de
Subject: Re: [PATCH 5.0 30/46] x86/boot/compressed/64: Do not read legacy ROM on EFI system

On March 8, 2019 4:50:03 AM PST, Greg Kroah-Hartman <gregkh@...uxfoundation.org> wrote:
>5.0-stable review patch.  If anyone has any objections, please let me
>know.
>
>------------------
>
>From: Kirill A. Shutemov <kirill.shutemov@...ux.intel.com>
>
>commit 6f913de3231e1d70a871135b38219da7810df218 upstream.
>
>EFI systems do not necessarily provide a legacy ROM. If the ROM is
>missing
>the memory is not mapped at all.
>
>Trying to dereference values in the legacy ROM area leads to a crash on
>Macbook Pro.
>
>Only look for values in the legacy ROM area for non-EFI system.
>
>Fixes: 3548e131ec6a ("x86/boot/compressed/64: Find a place for 32-bit
>trampoline")
>Reported-by: Pitam Mitra <pitamm@...il.com>
>Signed-off-by: Kirill A. Shutemov <kirill.shutemov@...ux.intel.com>
>Signed-off-by: Thomas Gleixner <tglx@...utronix.de>
>Tested-by: Bockjoo Kim <bockjoo@...s.ufl.edu>
>Cc: bp@...en8.de
>Cc: hpa@...or.com
>Cc: stable@...r.kernel.org
>Link:
>https://lkml.kernel.org/r/20190219075224.35058-1-kirill.shutemov@linux.intel.com
>Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=202351
>Signed-off-by: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
>
>---
> arch/x86/boot/compressed/pgtable_64.c |   19 ++++++++++++++++---
> 1 file changed, 16 insertions(+), 3 deletions(-)
>
>--- a/arch/x86/boot/compressed/pgtable_64.c
>+++ b/arch/x86/boot/compressed/pgtable_64.c
>@@ -1,5 +1,7 @@
>+#include <linux/efi.h>
> #include <asm/e820/types.h>
> #include <asm/processor.h>
>+#include <asm/efi.h>
> #include "pgtable.h"
> #include "../string.h"
> 
>@@ -37,9 +39,10 @@ int cmdline_find_option_bool(const char
> 
> static unsigned long find_trampoline_placement(void)
> {
>-	unsigned long bios_start, ebda_start;
>+	unsigned long bios_start = 0, ebda_start = 0;
> 	unsigned long trampoline_start;
> 	struct boot_e820_entry *entry;
>+	char *signature;
> 	int i;
> 
> 	/*
>@@ -47,8 +50,18 @@ static unsigned long find_trampoline_pla
> 	 * This code is based on reserve_bios_regions().
> 	 */
> 
>-	ebda_start = *(unsigned short *)0x40e << 4;
>-	bios_start = *(unsigned short *)0x413 << 10;
>+	/*
>+	 * EFI systems may not provide legacy ROM. The memory may not be
>mapped
>+	 * at all.
>+	 *
>+	 * Only look for values in the legacy ROM for non-EFI system.
>+	 */
>+	signature = (char *)&boot_params->efi_info.efi_loader_signature;
>+	if (strncmp(signature, EFI32_LOADER_SIGNATURE, 4) &&
>+	    strncmp(signature, EFI64_LOADER_SIGNATURE, 4)) {
>+		ebda_start = *(unsigned short *)0x40e << 4;
>+		bios_start = *(unsigned short *)0x413 << 10;
>+	}
> 
> 	if (bios_start < BIOS_START_MIN || bios_start > BIOS_START_MAX)
> 		bios_start = BIOS_START_MAX;

Only one objection: the explanation is nonsensical. 
-- 
Sent from my Android device with K-9 Mail. Please excuse my brevity.