linux-kernel - Re: [PATCH 1/2] ARM/efi: Remove duplicate permission settings

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAMj1kXHs3vC4TEWg1ogG=N8Dd5L0rkQ=qAFLWKiAA5yi_He3GA@mail.gmail.com>
Date: Thu, 23 Oct 2025 10:30:55 +0200
From: Ard Biesheuvel <ardb@...nel.org>
To: Qiang Ma <maqianga@...ontech.com>
Cc: linux@...linux.org.uk, linux-efi@...r.kernel.org, 
	linux-kernel@...r.kernel.org, linux-arm-kernel@...ts.infradead.org
Subject: Re: [PATCH 1/2] ARM/efi: Remove duplicate permission settings

On Thu, 23 Oct 2025 at 10:22, Qiang Ma <maqianga@...ontech.com> wrote:
>
> In the efi_virtmap_init(), permission settings have been applied:
>
> static bool __init efi_virtmap_init(void)
> {
>         ...
>         for_each_efi_memory_desc(md)
>                 ...
>                 efi_create_mapping(&efi_mm, md);
>         ...
>         efi_memattr_apply_permissions(&efi_mm, efi_set_mapping_permissions);
>         ...
> }
>
> Therefore, there is no need to apply it again in the efi_create_mapping().
>
> Fixes: 9fc68b717c24 ("ARM/efi: Apply strict permissions for UEFI Runtime Services regions")
>
> Signed-off-by: Qiang Ma <maqianga@...ontech.com>

No, efi_memattr_apply_permissions() uses the /optional/ memory
attributes table, whereas efi_create_mapping() uses the permission
attributes in the EFI memory map. The memory attributes table is
optional, in which case any RO/XP attributes from the memory map
should be used.


> ---
>  arch/arm/kernel/efi.c | 5 -----
>  1 file changed, 5 deletions(-)
>
> diff --git a/arch/arm/kernel/efi.c b/arch/arm/kernel/efi.c
> index 6f9ec7d28a71..d2fca20d912e 100644
> --- a/arch/arm/kernel/efi.c
> +++ b/arch/arm/kernel/efi.c
> @@ -70,11 +70,6 @@ int __init efi_create_mapping(struct mm_struct *mm, efi_memory_desc_t *md)
>
>         create_mapping_late(mm, &desc, true);
>
> -       /*
> -        * If stricter permissions were specified, apply them now.
> -        */
> -       if (md->attribute & (EFI_MEMORY_RO | EFI_MEMORY_XP))
> -               return efi_set_mapping_permissions(mm, md, false);
>         return 0;
>  }
>
> --
> 2.20.1
>