linux-kernel - Re: [PATCH] MIPS: fw: Gracefully handle unknown firmware protocols

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <8c49fec9-2afc-44ca-aebc-d08ae0d11305@app.fastmail.com>
Date: Mon, 26 Aug 2024 14:17:39 +0100
From: "Jiaxun Yang" <jiaxun.yang@...goat.com>
To: Bjørn Mork <bjorn@...k.no>
Cc: "Thomas Bogendoerfer" <tsbogend@...ha.franken.de>,
 "Steven J . Hill" <Steven.Hill@...tec.com>,
 "linux-mips@...r.kernel.org" <linux-mips@...r.kernel.org>,
 linux-kernel@...r.kernel.org,
 "stable@...r.kernel.org" <stable@...r.kernel.org>
Subject: Re: [PATCH] MIPS: fw: Gracefully handle unknown firmware protocols

在2024年8月25日八月 下午3:44，Bjørn Mork写道：
> "Jiaxun Yang" <jiaxun.yang@...goat.com> writes:
>> 在2024年8月24日八月 下午3:41，Bjørn Mork写道：
>>> Boards based on the same SoC family can use different boot loaders.
>>> These may pass numeric arguments which we erroneously interpret as
>>> command line or environment pointers. Such errors will cause boot
>>> to halt at an early stage since commit 056a68cea01e ("mips: allow
>>> firmware to pass RNG seed to kernel").
>>>
>>> One known example of this issue is a HPE switch using a BootWare
>>> boot loader.  It was found to pass these arguments to the kernel:
>>>
>>>   0x00020000 0x00060000 0xfffdffff 0x0000416c
>>>
>>> We can avoid hanging by validating that both passed pointers are in
>>> KSEG1 as expected.
>>
>> Hi Bjorn,
>>
>> This is actually breaking 64 bit systems passing fw_args in XKPHYS or KSEG0.
>
> Ouch.  Thanks for the feedback.
>
> But if so, then aren't those already broken with the current test
> against CKSEG0?  I didn't add that.
>

Ah my bad. My impression was it is possible to pass args in XKPHYS with
existing infra (and some PMON bootloader is doing that) but it turns out that
capability was somehow dropped when I was migrating various platforms to
fw_init_cmdline.

Feel free to propose a patch and go with valid_fw_arg, it's always good to have 
robust generic implementation for validating stuff.

In long term we may need to clean up this as Maciej suggested, but IMO going through
jungle of platforms is not a feasible task for casual contributors.

Thanks
-- 
- Jiaxun