linux-kernel.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
* [PATCH v2] arch/x86: Check validity of EBDA pointer in mpparse.c
       [not found] <CAJZ5v0gBbdzUO9MRxbKESEnaeaNAu-+3oP6ADMretch=iHPNJA@mail.gmail.com>
@ 2022-04-08  8:46 ` Vit Kabele
  2022-05-03 17:36   ` Borislav Petkov
  0 siblings, 1 reply; 5+ messages in thread
From: Vit Kabele @ 2022-04-08  8:46 UTC (permalink / raw)
  To: platform-driver-x86; +Cc: r.marek, x86, linux-kernel, rafael, mingo

The pointer to EBDA area is retrieved from a word at 0x40e in BDA.
In case that the memory there is not initialized and contains garbage,
it might happen that the kernel touches memory above 640K.

This may cause unwanted reads from VGA memory which may not be decoded,
or even present when running under virtualization.

This patch adds sanity check for the EBDA pointer retrieved from the memory
so that scanning EBDA does not leave the low memory.

Signed-off-by: Vit Kabele <vit@kabele.me>
Reviewed-by: Rudolf Marek <r.marek@assembler.cz>
---
changes in v2:
 * Fix the comment formating
 * Change the condition. I used already defined symbol for easier
    interpretation

 arch/x86/include/asm/bios_ebda.h |  3 +++
 arch/x86/kernel/ebda.c           |  3 ---
 arch/x86/kernel/mpparse.c        | 14 ++++++++++++--
 3 files changed, 15 insertions(+), 5 deletions(-)

diff --git a/arch/x86/include/asm/bios_ebda.h b/arch/x86/include/asm/bios_ebda.h
index 4d5a17e2febe..c3133c01d5b7 100644
--- a/arch/x86/include/asm/bios_ebda.h
+++ b/arch/x86/include/asm/bios_ebda.h
@@ -4,6 +4,9 @@
 
 #include <asm/io.h>
 
+#define BIOS_START_MIN		0x20000U	/* 128K, less than this is insane */
+#define BIOS_START_MAX		0x9f000U	/* 640K, absolute maximum */
+
 /*
  * Returns physical address of EBDA.  Returns 0 if there is no EBDA.
  */
diff --git a/arch/x86/kernel/ebda.c b/arch/x86/kernel/ebda.c
index 38e7d597b660..86c0801fc3ce 100644
--- a/arch/x86/kernel/ebda.c
+++ b/arch/x86/kernel/ebda.c
@@ -50,9 +50,6 @@
 
 #define BIOS_RAM_SIZE_KB_PTR	0x413
 
-#define BIOS_START_MIN		0x20000U	/* 128K, less than this is insane */
-#define BIOS_START_MAX		0x9f000U	/* 640K, absolute maximum */
-
 void __init reserve_bios_regions(void)
 {
 	unsigned int bios_start, ebda_start;
diff --git a/arch/x86/kernel/mpparse.c b/arch/x86/kernel/mpparse.c
index fed721f90116..9e0b4820f33b 100644
--- a/arch/x86/kernel/mpparse.c
+++ b/arch/x86/kernel/mpparse.c
@@ -633,8 +633,18 @@ void __init default_find_smp_config(void)
 	 */
 
 	address = get_bios_ebda();
-	if (address)
-		smp_scan_config(address, 0x400);
+
+	/*
+	 * Check that the EBDA address is sane and the get_bios_ebda() did not
+	 * return just garbage from memory.
+	 * The upper bound is considered valid if it points below 1K before
+	 * end of the lower memory (i.e. 639K). The EBDA can be smaller
+	 * than 1K in which case the pointer will point above 639K but that
+	 * case is handled in step 2) above, and we don't need to adjust scan
+	 * size to not bump into the memory above 640K.
+	 */
+	if (address >= BIOS_START_MIN && address < (BIOS_START_MAX - 1024))
+		smp_scan_config(address, 1024);
 }
 
 #ifdef CONFIG_X86_IO_APIC
-- 
2.30.2


^ permalink raw reply related	[flat|nested] 5+ messages in thread

* Re: [PATCH v2] arch/x86: Check validity of EBDA pointer in mpparse.c
  2022-04-08  8:46 ` [PATCH v2] arch/x86: Check validity of EBDA pointer in mpparse.c Vit Kabele
@ 2022-05-03 17:36   ` Borislav Petkov
  2022-05-16  9:43     ` Vit Kabele
  0 siblings, 1 reply; 5+ messages in thread
From: Borislav Petkov @ 2022-05-03 17:36 UTC (permalink / raw)
  To: Vit Kabele; +Cc: platform-driver-x86, r.marek, x86, linux-kernel, rafael, mingo

On Fri, Apr 08, 2022 at 10:46:46AM +0200, Vit Kabele wrote:
> The pointer to EBDA area is retrieved from a word at 0x40e in BDA.
> In case that the memory there is not initialized and contains garbage,
> it might happen that the kernel touches memory above 640K.

This is where I'm missing the "why do this" at all. Grepping back in
my mbox, I see another thread from you where you say something about
"testing custom virtualization platform".

So I'd like to see why this fix is needed so feel free to elaborate in the
commit message what the situation is and why you're doing this.

> This may cause unwanted reads from VGA memory which may not be decoded,
> or even present when running under virtualization.
> 
> This patch adds sanity check for the EBDA pointer retrieved from the memory

Avoid having "This patch" or "This commit" in the commit message. It is
tautologically useless.

IOW,

s/This patch adds/Add/

> diff --git a/arch/x86/kernel/mpparse.c b/arch/x86/kernel/mpparse.c
> index fed721f90116..9e0b4820f33b 100644
> --- a/arch/x86/kernel/mpparse.c
> +++ b/arch/x86/kernel/mpparse.c
> @@ -633,8 +633,18 @@ void __init default_find_smp_config(void)
>  	 */
>  
>  	address = get_bios_ebda();
> -	if (address)
> -		smp_scan_config(address, 0x400);
> +
> +	/*
> +	 * Check that the EBDA address is sane and the get_bios_ebda() did not
> +	 * return just garbage from memory.
> +	 * The upper bound is considered valid if it points below 1K before
> +	 * end of the lower memory (i.e. 639K). The EBDA can be smaller
> +	 * than 1K in which case the pointer will point above 639K but that
> +	 * case is handled in step 2) above, and we don't need to adjust scan
> +	 * size to not bump into the memory above 640K.
> +	 */
> +	if (address >= BIOS_START_MIN && address < (BIOS_START_MAX - 1024))
> +		smp_scan_config(address, 1024);
>  }

I guess but looking at reserve_bios_regions(), that function is already
doing kinda the same along with being a bit more careful to figure out
bios_start so you could unify the code into a common helper and use it
at both places?

Thx.

-- 
Regards/Gruss,
    Boris.

https://people.kernel.org/tglx/notes-about-netiquette

^ permalink raw reply	[flat|nested] 5+ messages in thread

* Re: [PATCH v2] arch/x86: Check validity of EBDA pointer in mpparse.c
  2022-05-03 17:36   ` Borislav Petkov
@ 2022-05-16  9:43     ` Vit Kabele
  2022-05-17 19:21       ` Borislav Petkov
  0 siblings, 1 reply; 5+ messages in thread
From: Vit Kabele @ 2022-05-16  9:43 UTC (permalink / raw)
  To: Borislav Petkov
  Cc: platform-driver-x86, r.marek, x86, linux-kernel, rafael, mingo

On Tue, May 03, 2022 at 07:36:35PM +0200, Borislav Petkov wrote:
> > diff --git a/arch/x86/kernel/mpparse.c b/arch/x86/kernel/mpparse.c
> > index fed721f90116..9e0b4820f33b 100644
> > --- a/arch/x86/kernel/mpparse.c
> > +++ b/arch/x86/kernel/mpparse.c
> > @@ -633,8 +633,18 @@ void __init default_find_smp_config(void)
> >  	 */
> >  
> >  	address = get_bios_ebda();
> > -	if (address)
> > -		smp_scan_config(address, 0x400);
> > +
> > +	/*
> > +	 * Check that the EBDA address is sane and the get_bios_ebda() did not
> > +	 * return just garbage from memory.
> > +	 * The upper bound is considered valid if it points below 1K before
> > +	 * end of the lower memory (i.e. 639K). The EBDA can be smaller
> > +	 * than 1K in which case the pointer will point above 639K but that
> > +	 * case is handled in step 2) above, and we don't need to adjust scan
> > +	 * size to not bump into the memory above 640K.
> > +	 */
> > +	if (address >= BIOS_START_MIN && address < (BIOS_START_MAX - 1024))
> > +		smp_scan_config(address, 1024);
> >  }
> 
> I guess but looking at reserve_bios_regions(), that function is already
> doing kinda the same along with being a bit more careful to figure out
> bios_start so you could unify the code into a common helper and use it
> at both places?
I also initially thought of extracting the check to a separate method,
but imo this decreases the overall code readability. Any function
calling the get_bios_ebda() must check the returned value anyway, so
there will be always at least one if statement involved. And the valid
upper bound of the EBDA pointer is also different for these two use-cases.
(The mpparse.c usage is interested in EBDA pointer only if it ends 1KiB
before the end of low memory, while the ebda.c accepts even the values in the
last KiB below 640KiB).

I also consider it unlikely that there will be some new code using
the same bounds check, so I'd prefer to leave it inline.

-- 
Best regards,
Vit Kabele

^ permalink raw reply	[flat|nested] 5+ messages in thread

* Re: [PATCH v2] arch/x86: Check validity of EBDA pointer in mpparse.c
  2022-05-16  9:43     ` Vit Kabele
@ 2022-05-17 19:21       ` Borislav Petkov
  2022-07-21 15:38         ` Vit Kabele
  0 siblings, 1 reply; 5+ messages in thread
From: Borislav Petkov @ 2022-05-17 19:21 UTC (permalink / raw)
  To: Vit Kabele; +Cc: platform-driver-x86, r.marek, x86, linux-kernel, rafael, mingo

On Mon, May 16, 2022 at 11:43:48AM +0200, Vit Kabele wrote:
>  And the valid upper bound of the EBDA pointer is also different
> for these two use-cases. (The mpparse.c usage is interested in EBDA
> pointer only if it ends 1KiB before the end of low memory, while the
> ebda.c accepts even the values in the last KiB below 640KiB).

And I still don't know why this difference in the upper bounds is really
relevant and why you can't simply use the code in reserve_bios_regions()
after carving it out in a helper?

The latter considers ebda_start valid when it is between BIOS_START_MIN
and bios_start, after having sanitized that bios_start to 640K if "out
of bounds".

Why can't default_find_smp_config() simply scan the last KiB below
640KiB twice for the sake of simpler code?

I.e., there needs to be a single get_bios_ebda() - the current one can
be renamed to __get_bios_ebda() - and that get_bios_ebda() should give
either a sane EBDA address or 0 if the checks don't pass. And all code
should use that.

-- 
Regards/Gruss,
    Boris.

https://people.kernel.org/tglx/notes-about-netiquette

^ permalink raw reply	[flat|nested] 5+ messages in thread

* Re: [PATCH v2] arch/x86: Check validity of EBDA pointer in mpparse.c
  2022-05-17 19:21       ` Borislav Petkov
@ 2022-07-21 15:38         ` Vit Kabele
  0 siblings, 0 replies; 5+ messages in thread
From: Vit Kabele @ 2022-07-21 15:38 UTC (permalink / raw)
  To: Borislav Petkov, Vit Kabele
  Cc: platform-driver-x86, r.marek, x86, linux-kernel, rafael, mingo

On Tue, May 17, 2022 at 09:21:57PM +0200, Borislav Petkov wrote:
> Why can't default_find_smp_config() simply scan the last KiB below
> 640KiB twice for the sake of simpler code?
The problem is not in scanning the last KiB twice. But when the
ebda start is between 639 and 640 KiB, we need to adjust the size of the
scan window like MIN(1024, 640 * 1024 - address), because we don't want
to bump into the memory above 640K.

This is obviously not a problem to do, but since we are talking about
+/- a few lines, I thought it is more readable like that.

> I.e., there needs to be a single get_bios_ebda() - the current one can
> be renamed to __get_bios_ebda() - and that get_bios_ebda() should give
> either a sane EBDA address or 0 if the checks don't pass. And all code
> should use that.
I can do that if you consider it better, but it is a little bit more
lines and some code has to be duplicated.  E.g. the
reserve_bios_regions() cares about MIN(bios_start, ebda_start), so it
needs to read the BIOS_RAM_SIZE_KB_PTR and check its sanity anyway.
Since this is basically the code that would be carved out to the new
get_bios_ebda() helper, we don't save anything.

-- 
Best regards,
Vit Kabele

^ permalink raw reply	[flat|nested] 5+ messages in thread

end of thread, other threads:[~2022-07-21 15:42 UTC | newest]

Thread overview: 5+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
     [not found] <CAJZ5v0gBbdzUO9MRxbKESEnaeaNAu-+3oP6ADMretch=iHPNJA@mail.gmail.com>
2022-04-08  8:46 ` [PATCH v2] arch/x86: Check validity of EBDA pointer in mpparse.c Vit Kabele
2022-05-03 17:36   ` Borislav Petkov
2022-05-16  9:43     ` Vit Kabele
2022-05-17 19:21       ` Borislav Petkov
2022-07-21 15:38         ` Vit Kabele

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).