linux-kernel - Re: [PATCH 5.0 30/46] x86/boot/compressed/64: Do not read legacy ROM on EFI system

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20190310061840.GA21641@kroah.com>
Date:   Sun, 10 Mar 2019 07:18:40 +0100
From:   Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To:     hpa@...or.com
Cc:     linux-kernel@...r.kernel.org, stable@...r.kernel.org,
        Pitam Mitra <pitamm@...il.com>,
        "Kirill A. Shutemov" <kirill.shutemov@...ux.intel.com>,
        Thomas Gleixner <tglx@...utronix.de>,
        Bockjoo Kim <bockjoo@...s.ufl.edu>, bp@...en8.de
Subject: Re: [PATCH 5.0 30/46] x86/boot/compressed/64: Do not read legacy ROM
 on EFI system

On Sat, Mar 09, 2019 at 10:10:19PM -0800, hpa@...or.com wrote:
> On March 8, 2019 4:50:03 AM PST, Greg Kroah-Hartman <gregkh@...uxfoundation.org> wrote:
> >5.0-stable review patch.  If anyone has any objections, please let me
> >know.
> >
> >------------------
> >
> >From: Kirill A. Shutemov <kirill.shutemov@...ux.intel.com>
> >
> >commit 6f913de3231e1d70a871135b38219da7810df218 upstream.
> >
> >EFI systems do not necessarily provide a legacy ROM. If the ROM is
> >missing
> >the memory is not mapped at all.
> >
> >Trying to dereference values in the legacy ROM area leads to a crash on
> >Macbook Pro.
> >
> >Only look for values in the legacy ROM area for non-EFI system.
> >
> >Fixes: 3548e131ec6a ("x86/boot/compressed/64: Find a place for 32-bit
> >trampoline")
> >Reported-by: Pitam Mitra <pitamm@...il.com>
> >Signed-off-by: Kirill A. Shutemov <kirill.shutemov@...ux.intel.com>
> >Signed-off-by: Thomas Gleixner <tglx@...utronix.de>
> >Tested-by: Bockjoo Kim <bockjoo@...s.ufl.edu>
> >Cc: bp@...en8.de
> >Cc: hpa@...or.com
> >Cc: stable@...r.kernel.org
> >Link:
> >https://lkml.kernel.org/r/20190219075224.35058-1-kirill.shutemov@linux.intel.com
> >Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=202351
> >Signed-off-by: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
> >
> >---
> > arch/x86/boot/compressed/pgtable_64.c |   19 ++++++++++++++++---
> > 1 file changed, 16 insertions(+), 3 deletions(-)
> >
> >--- a/arch/x86/boot/compressed/pgtable_64.c
> >+++ b/arch/x86/boot/compressed/pgtable_64.c
> >@@ -1,5 +1,7 @@
> >+#include <linux/efi.h>
> > #include <asm/e820/types.h>
> > #include <asm/processor.h>
> >+#include <asm/efi.h>
> > #include "pgtable.h"
> > #include "../string.h"
> > 
> >@@ -37,9 +39,10 @@ int cmdline_find_option_bool(const char
> > 
> > static unsigned long find_trampoline_placement(void)
> > {
> >-	unsigned long bios_start, ebda_start;
> >+	unsigned long bios_start = 0, ebda_start = 0;
> > 	unsigned long trampoline_start;
> > 	struct boot_e820_entry *entry;
> >+	char *signature;
> > 	int i;
> > 
> > 	/*
> >@@ -47,8 +50,18 @@ static unsigned long find_trampoline_pla
> > 	 * This code is based on reserve_bios_regions().
> > 	 */
> > 
> >-	ebda_start = *(unsigned short *)0x40e << 4;
> >-	bios_start = *(unsigned short *)0x413 << 10;
> >+	/*
> >+	 * EFI systems may not provide legacy ROM. The memory may not be
> >mapped
> >+	 * at all.
> >+	 *
> >+	 * Only look for values in the legacy ROM for non-EFI system.
> >+	 */
> >+	signature = (char *)&boot_params->efi_info.efi_loader_signature;
> >+	if (strncmp(signature, EFI32_LOADER_SIGNATURE, 4) &&
> >+	    strncmp(signature, EFI64_LOADER_SIGNATURE, 4)) {
> >+		ebda_start = *(unsigned short *)0x40e << 4;
> >+		bios_start = *(unsigned short *)0x413 << 10;
> >+	}
> > 
> > 	if (bios_start < BIOS_START_MIN || bios_start > BIOS_START_MAX)
> > 		bios_start = BIOS_START_MAX;
> 
> Only one objection: the explanation is nonsensical. 

Heh, take it up with the original submitter, I don't change the
changelog text after it hits Linus's tree :)

greg k-h