All of lore.kernel.org
 help / color / mirror / Atom feed
From: "Jason A. Donenfeld" <Jason@zx2c4.com>
To: Ard Biesheuvel <ardb@kernel.org>
Cc: linux-arm-kernel <linux-arm-kernel@lists.infradead.org>,
	ACPI Devel Maling List <linux-acpi@vger.kernel.org>,
	Will Deacon <will@kernel.org>,
	Catalin Marinas <catalin.marinas@arm.com>,
	lorenzo.pieralisi@arm.com, sudeep.holla@arm.com,
	Kernel Hardening <kernel-hardening@lists.openwall.com>
Subject: Re: [RFC PATCH] arm64/acpi: disallow AML memory opregions to access kernel memory
Date: Mon, 22 Jun 2020 15:15:18 -0600	[thread overview]
Message-ID: <CAHmME9q=dYdf1sn_Kvo5Fu0cUUOGQAMDerb+8g2_-AKhvMukew@mail.gmail.com> (raw)
In-Reply-To: <CAHmME9oNwDra2Vi+jsy4YZ81HVygyyRXTJeni58CaJqOmfmepA@mail.gmail.com>

Hmm, actually...

> >         if (memblock_is_map_memory(phys))
> > -               return (void __iomem *)__phys_to_virt(phys);
> > +               return NULL;

It might be prudent to have this check take into account the size of
the region being mapped. I realize ACPI considers it to be undefined
if you cross borders, but I could imagine actual system behavior being
somewhat complicated, and a clever bypass being possible.
Hypothetically: KASLR starts kernel at phys_base+offset, [phys_base,
rounddownpage(offset)) doesn't get mapped, malicious acpi then maps
phys_base+rounddownpage(offset)-1, and then this check doesn't get
hit.

  reply	other threads:[~2020-06-22 21:15 UTC|newest]

Thread overview: 9+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2020-06-22  9:27 [RFC PATCH] arm64/acpi: disallow AML memory opregions to access kernel memory Ard Biesheuvel
2020-06-22 21:09 ` Jason A. Donenfeld
2020-06-22 21:09   ` Jason A. Donenfeld
2020-06-22 21:15   ` Jason A. Donenfeld [this message]
2020-06-22 21:15     ` Jason A. Donenfeld
2020-06-23  8:13 ` Will Deacon
2020-06-23  8:16   ` Ard Biesheuvel
2020-06-23  8:16     ` Ard Biesheuvel
2020-06-23  9:14     ` Will Deacon

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to='CAHmME9q=dYdf1sn_Kvo5Fu0cUUOGQAMDerb+8g2_-AKhvMukew@mail.gmail.com' \
    --to=jason@zx2c4.com \
    --cc=ardb@kernel.org \
    --cc=catalin.marinas@arm.com \
    --cc=kernel-hardening@lists.openwall.com \
    --cc=linux-acpi@vger.kernel.org \
    --cc=linux-arm-kernel@lists.infradead.org \
    --cc=lorenzo.pieralisi@arm.com \
    --cc=sudeep.holla@arm.com \
    --cc=will@kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.