shaba/systemd-stable
1
1
Fork 0
mirror of https://github.com/systemd/systemd-stable.git synced 2025-03-12 08:58:20 +03:00
Code

boot: skip loading DTBs in type 1 when secure boot is enabled

Browse Source 
The kernel loads the DTB from EFI before ExitBootServices():

https://github.com/torvalds/linux/blob/v6.5/drivers/firmware/efi/libstub/fdt.c#L245

DTBs can map and assign arbitrary memory ranges. The kernel refuses
to load one from the dtb= kernel command line parameter when secure
boot is enabled, as it's not safe. Let's do the same for type 1
entries, as they are unverified.

This only affects arm64 and riscv64, firmwares do not support DTB
on x86.

(cherry picked from commit 4b4d612d860a4acbbc22bc64a32637c0eb792cee)
(cherry picked from commit c1404fff32d439a726e972daa34470c863465577)
(cherry picked from commit 7844c655bec7264f009267bd63ccbc712b64806e)
(cherry picked from commit f3813207608174c0b1cbb08e176e4d5bec283ceb)
This commit is contained in:
Luca Boccassi 2023-09-17 00:23:37 +01:00 committed by Luca Boccassi
parent 83ecef0d76
commit 3c97ff5907
1 changed files with 3 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
src/boot/efi/boot.c
View File

@ -2346,7 +2346,9 @@ static EFI_STATUS image_start(
if (EFI_ERROR(err)) if (EFI_ERROR(err))
return log_error_status_stall(err, L"Error loading %s: %r", entry->loader, err); return log_error_status_stall(err, L"Error loading %s: %r", entry->loader, err);
if (entry->devicetree) { /* DTBs are loaded by the kernel before ExitBootServices, and they can be used to map and assign
* arbitrary memory ranges, so skip it when secure boot is enabled as the DTB here is unverified. */
if (entry->devicetree && !secure_boot_enabled()) {
err = devicetree_install(&dtstate, image_root, entry->devicetree); err = devicetree_install(&dtstate, image_root, entry->devicetree);
if (EFI_ERROR(err)) if (EFI_ERROR(err))
return log_error_status_stall(err, L"Error loading %s: %r", entry->devicetree, err); return log_error_status_stall(err, L"Error loading %s: %r", entry->devicetree, err);