diff options
Diffstat (limited to 'debian/patches/bugfix/x86/x86-efistub-Clear-decompressor-BSS-in-native-EFI-ent.patch')
| -rw-r--r-- | debian/patches/bugfix/x86/x86-efistub-Clear-decompressor-BSS-in-native-EFI-ent.patch | 68 |
1 files changed, 68 insertions, 0 deletions
diff --git a/debian/patches/bugfix/x86/x86-efistub-Clear-decompressor-BSS-in-native-EFI-ent.patch b/debian/patches/bugfix/x86/x86-efistub-Clear-decompressor-BSS-in-native-EFI-ent.patch new file mode 100644 index 000000000..63c4cafae --- /dev/null +++ b/debian/patches/bugfix/x86/x86-efistub-Clear-decompressor-BSS-in-native-EFI-ent.patch @@ -0,0 +1,68 @@ +From: Ard Biesheuvel <ardb@kernel.org> +Date: Fri, 15 Mar 2024 16:26:16 +0100 +Subject: x86/efistub: Clear decompressor BSS in native EFI entrypoint +Origin: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git/commit?id=9274ec2003042bf0ed847cb80ffcfab543a0a33a + +[ Upstream commit b3810c5a2cc4a6665f7a65bed5393c75ce3f3aa2 ] + +The EFI stub on x86 no longer invokes the decompressor as a subsequent +boot stage, but calls into the decompression code directly while running +in the context of the EFI boot services. + +This means that when using the native EFI entrypoint (as opposed to the +EFI handover protocol, which clears BSS explicitly), the firmware PE +image loader is being relied upon to ensure that BSS is zeroed before +the EFI stub is entered from the firmware. + +As Radek's report proves, this is a bad idea. Not all loaders do this +correctly, which means some global variables that should be statically +initialized to 0x0 may have junk in them. + +So clear BSS explicitly when entering via efi_pe_entry(). Note that +zeroing BSS from C code is not generally safe, but in this case, the +following assignment and dereference of a global pointer variable +ensures that the memset() cannot be deferred or reordered. + +Cc: <stable@kernel.org> # v6.1+ +Reported-by: Radek Podgorny <radek@podgorny.cz> +Closes: https://lore.kernel.org/all/a99a831a-8ad5-4cb0-bff9-be637311f771@podgorny.cz +Signed-off-by: Ard Biesheuvel <ardb@kernel.org> +Signed-off-by: Sasha Levin <sashal@kernel.org> +--- + drivers/firmware/efi/libstub/x86-stub.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/firmware/efi/libstub/x86-stub.c b/drivers/firmware/efi/libstub/x86-stub.c +index 784e1b2ae5cc..aa07051459f5 100644 +--- a/drivers/firmware/efi/libstub/x86-stub.c ++++ b/drivers/firmware/efi/libstub/x86-stub.c +@@ -21,6 +21,8 @@ + #include "efistub.h" + #include "x86-stub.h" + ++extern char _bss[], _ebss[]; ++ + const efi_system_table_t *efi_system_table; + const efi_dxe_services_table_t *efi_dxe_table; + static efi_loaded_image_t *image = NULL; +@@ -432,6 +434,8 @@ efi_status_t __efiapi efi_pe_entry(efi_handle_t handle, + efi_status_t status; + char *cmdline_ptr; + ++ memset(_bss, 0, _ebss - _bss); ++ + efi_system_table = sys_table_arg; + + /* Check if we were booted by the EFI firmware */ +@@ -950,8 +954,6 @@ void __noreturn efi_stub_entry(efi_handle_t handle, + void efi_handover_entry(efi_handle_t handle, efi_system_table_t *sys_table_arg, + struct boot_params *boot_params) + { +- extern char _bss[], _ebss[]; +- + memset(_bss, 0, _ebss - _bss); + efi_stub_entry(handle, sys_table_arg, boot_params); + } +-- +2.43.0 + |