[PATCH v2] arch/x86: Check validity of EBDA pointer in mpparse.c

[PATCH v2] arch/x86: Check validity of EBDA pointer in mpparse.c

[Vit Kabele]

The pointer to EBDA area is retrieved from a word at 0x40e in BDA.
In case that the memory there is not initialized and contains garbage,
it might happen that the kernel touches memory above 640K.

This may cause unwanted reads from VGA memory which may not be decoded,
or even present when running under virtualization.

This patch adds sanity check for the EBDA pointer retrieved from the memory
so that scanning EBDA does not leave the low memory.

Signed-off-by: Vit Kabele <vit@kabele.me>
Reviewed-by: Rudolf Marek <r.marek@assembler.cz>
---
changes in v2:
 * Fix the comment formating
 * Change the condition. I used already defined symbol for easier
    interpretation

 arch/x86/include/asm/bios_ebda.h |  3 +++
 arch/x86/kernel/ebda.c           |  3 ---
 arch/x86/kernel/mpparse.c        | 14 ++++++++++++--
 3 files changed, 15 insertions(+), 5 deletions(-)

diff --git a/arch/x86/include/asm/bios_ebda.h b/arch/x86/include/asm/bios_ebda.h
index 4d5a17e2febe..c3133c01d5b7 100644
--- a/arch/x86/include/asm/bios_ebda.h
+++ b/arch/x86/include/asm/bios_ebda.h
@@ -4,6 +4,9 @@
 
 #include <asm/io.h>
 
+#define BIOS_START_MIN		0x20000U	/* 128K, less than this is insane */
+#define BIOS_START_MAX		0x9f000U	/* 640K, absolute maximum */
+
 /*
  * Returns physical address of EBDA.  Returns 0 if there is no EBDA.
  */
diff --git a/arch/x86/kernel/ebda.c b/arch/x86/kernel/ebda.c
index 38e7d597b660..86c0801fc3ce 100644
--- a/arch/x86/kernel/ebda.c
+++ b/arch/x86/kernel/ebda.c
@@ -50,9 +50,6 @@
 
 #define BIOS_RAM_SIZE_KB_PTR	0x413
 
-#define BIOS_START_MIN		0x20000U	/* 128K, less than this is insane */
-#define BIOS_START_MAX		0x9f000U	/* 640K, absolute maximum */
-
 void __init reserve_bios_regions(void)
 {
 	unsigned int bios_start, ebda_start;
diff --git a/arch/x86/kernel/mpparse.c b/arch/x86/kernel/mpparse.c
index fed721f90116..9e0b4820f33b 100644
--- a/arch/x86/kernel/mpparse.c
+++ b/arch/x86/kernel/mpparse.c
@@ -633,8 +633,18 @@ void __init default_find_smp_config(void)
 	 */
 
 	address = get_bios_ebda();
-	if (address)
-		smp_scan_config(address, 0x400);
+
+	/*
+	 * Check that the EBDA address is sane and the get_bios_ebda() did not
+	 * return just garbage from memory.
+	 * The upper bound is considered valid if it points below 1K before
+	 * end of the lower memory (i.e. 639K). The EBDA can be smaller
+	 * than 1K in which case the pointer will point above 639K but that
+	 * case is handled in step 2) above, and we don't need to adjust scan
+	 * size to not bump into the memory above 640K.
+	 */
+	if (address >= BIOS_START_MIN && address < (BIOS_START_MAX - 1024))
+		smp_scan_config(address, 1024);
 }
 
 #ifdef CONFIG_X86_IO_APIC
-- 
2.30.2

Re: [PATCH v2] arch/x86: Check validity of EBDA pointer in mpparse.c

[Borislav Petkov]

On Fri, Apr 08, 2022 at 10:46:46AM +0200, Vit Kabele wrote:
> The pointer to EBDA area is retrieved from a word at 0x40e in BDA.
> In case that the memory there is not initialized and contains garbage,
> it might happen that the kernel touches memory above 640K.

This is where I'm missing the "why do this" at all. Grepping back in
my mbox, I see another thread from you where you say something about
"testing custom virtualization platform".

So I'd like to see why this fix is needed so feel free to elaborate in the
commit message what the situation is and why you're doing this.

> This may cause unwanted reads from VGA memory which may not be decoded,
> or even present when running under virtualization.
> 
> This patch adds sanity check for the EBDA pointer retrieved from the memory

Avoid having "This patch" or "This commit" in the commit message. It is
tautologically useless.

IOW,

s/This patch adds/Add/

> diff --git a/arch/x86/kernel/mpparse.c b/arch/x86/kernel/mpparse.c
> index fed721f90116..9e0b4820f33b 100644
> --- a/arch/x86/kernel/mpparse.c
> +++ b/arch/x86/kernel/mpparse.c
> @@ -633,8 +633,18 @@ void __init default_find_smp_config(void)
>  	 */
>  
>  	address = get_bios_ebda();
> -	if (address)
> -		smp_scan_config(address, 0x400);
> +
> +	/*
> +	 * Check that the EBDA address is sane and the get_bios_ebda() did not
> +	 * return just garbage from memory.
> +	 * The upper bound is considered valid if it points below 1K before
> +	 * end of the lower memory (i.e. 639K). The EBDA can be smaller
> +	 * than 1K in which case the pointer will point above 639K but that
> +	 * case is handled in step 2) above, and we don't need to adjust scan
> +	 * size to not bump into the memory above 640K.
> +	 */
> +	if (address >= BIOS_START_MIN && address < (BIOS_START_MAX - 1024))
> +		smp_scan_config(address, 1024);
>  }

I guess but looking at reserve_bios_regions(), that function is already
doing kinda the same along with being a bit more careful to figure out
bios_start so you could unify the code into a common helper and use it
at both places?

Thx.

-- 
Regards/Gruss,
    Boris.

https://people.kernel.org/tglx/notes-about-netiquette

Re: [PATCH v2] arch/x86: Check validity of EBDA pointer in mpparse.c

[Vit Kabele]

On Tue, May 03, 2022 at 07:36:35PM +0200, Borislav Petkov wrote:
> > diff --git a/arch/x86/kernel/mpparse.c b/arch/x86/kernel/mpparse.c
> > index fed721f90116..9e0b4820f33b 100644
> > --- a/arch/x86/kernel/mpparse.c
> > +++ b/arch/x86/kernel/mpparse.c
> > @@ -633,8 +633,18 @@ void __init default_find_smp_config(void)
> >  	 */
> >  
> >  	address = get_bios_ebda();
> > -	if (address)
> > -		smp_scan_config(address, 0x400);
> > +
> > +	/*
> > +	 * Check that the EBDA address is sane and the get_bios_ebda() did not
> > +	 * return just garbage from memory.
> > +	 * The upper bound is considered valid if it points below 1K before
> > +	 * end of the lower memory (i.e. 639K). The EBDA can be smaller
> > +	 * than 1K in which case the pointer will point above 639K but that
> > +	 * case is handled in step 2) above, and we don't need to adjust scan
> > +	 * size to not bump into the memory above 640K.
> > +	 */
> > +	if (address >= BIOS_START_MIN && address < (BIOS_START_MAX - 1024))
> > +		smp_scan_config(address, 1024);
> >  }
> 
> I guess but looking at reserve_bios_regions(), that function is already
> doing kinda the same along with being a bit more careful to figure out
> bios_start so you could unify the code into a common helper and use it
> at both places?
I also initially thought of extracting the check to a separate method,
but imo this decreases the overall code readability. Any function
calling the get_bios_ebda() must check the returned value anyway, so
there will be always at least one if statement involved. And the valid
upper bound of the EBDA pointer is also different for these two use-cases.
(The mpparse.c usage is interested in EBDA pointer only if it ends 1KiB
before the end of low memory, while the ebda.c accepts even the values in the
last KiB below 640KiB).

I also consider it unlikely that there will be some new code using
the same bounds check, so I'd prefer to leave it inline.

-- 
Best regards,
Vit Kabele

Re: [PATCH v2] arch/x86: Check validity of EBDA pointer in mpparse.c

[Borislav Petkov]

On Mon, May 16, 2022 at 11:43:48AM +0200, Vit Kabele wrote:
>  And the valid upper bound of the EBDA pointer is also different
> for these two use-cases. (The mpparse.c usage is interested in EBDA
> pointer only if it ends 1KiB before the end of low memory, while the
> ebda.c accepts even the values in the last KiB below 640KiB).

And I still don't know why this difference in the upper bounds is really
relevant and why you can't simply use the code in reserve_bios_regions()
after carving it out in a helper?

The latter considers ebda_start valid when it is between BIOS_START_MIN
and bios_start, after having sanitized that bios_start to 640K if "out
of bounds".

Why can't default_find_smp_config() simply scan the last KiB below
640KiB twice for the sake of simpler code?

I.e., there needs to be a single get_bios_ebda() - the current one can
be renamed to __get_bios_ebda() - and that get_bios_ebda() should give
either a sane EBDA address or 0 if the checks don't pass. And all code
should use that.

-- 
Regards/Gruss,
    Boris.

https://people.kernel.org/tglx/notes-about-netiquette

Re: [PATCH v2] arch/x86: Check validity of EBDA pointer in mpparse.c

[Vit Kabele]

On Tue, May 17, 2022 at 09:21:57PM +0200, Borislav Petkov wrote:
> Why can't default_find_smp_config() simply scan the last KiB below
> 640KiB twice for the sake of simpler code?
The problem is not in scanning the last KiB twice. But when the
ebda start is between 639 and 640 KiB, we need to adjust the size of the
scan window like MIN(1024, 640 * 1024 - address), because we don't want
to bump into the memory above 640K.

This is obviously not a problem to do, but since we are talking about
+/- a few lines, I thought it is more readable like that.

> I.e., there needs to be a single get_bios_ebda() - the current one can
> be renamed to __get_bios_ebda() - and that get_bios_ebda() should give
> either a sane EBDA address or 0 if the checks don't pass. And all code
> should use that.
I can do that if you consider it better, but it is a little bit more
lines and some code has to be duplicated.  E.g. the
reserve_bios_regions() cares about MIN(bios_start, ebda_start), so it
needs to read the BIOS_RAM_SIZE_KB_PTR and check its sanity anyway.
Since this is basically the code that would be carved out to the new
get_bios_ebda() helper, we don't save anything.

-- 
Best regards,
Vit Kabele