shaba/systemd-stable
1
1
Fork 0
mirror of https://github.com/systemd/systemd-stable.git synced 2025-03-11 04:58:19 +03:00
Code

boot: skip loading DTBs in type 1 when secure boot is enabled

Browse Source 
The kernel loads the DTB from EFI before ExitBootServices():

https://github.com/torvalds/linux/blob/v6.5/drivers/firmware/efi/libstub/fdt.c#L245

DTBs can map and assign arbitrary memory ranges. The kernel refuses
to load one from the dtb= kernel command line parameter when secure
boot is enabled, as it's not safe. Let's do the same for type 1
entries, as they are unverified.

This only affects arm64 and riscv64, firmwares do not support DTB
on x86.

(cherry picked from commit 4b4d612d860a4acbbc22bc64a32637c0eb792cee)
(cherry picked from commit c1404fff32d439a726e972daa34470c863465577)
This commit is contained in:
Luca Boccassi 2023-09-17 00:23:37 +01:00 committed by Luca Boccassi
parent b6b50ac157
commit 7844c655be
1 changed files with 3 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
src/boot/efi/boot.c
View File

@ -2380,7 +2380,9 @@ static EFI_STATUS image_start(
if (err != EFI_SUCCESS)
return log_error_status(err, "Error loading %ls: %m", entry->loader);
if (entry->devicetree) {
/* DTBs are loaded by the kernel before ExitBootServices, and they can be used to map and assign
* arbitrary memory ranges, so skip it when secure boot is enabled as the DTB here is unverified. */
if (entry->devicetree && !secure_boot_enabled()) {
err = devicetree_install(&dtstate, image_root, entry->devicetree);
if (err != EFI_SUCCESS)
return log_error_status(err, "Error loading %ls: %m", entry->devicetree);