[03/11] ACPICA: Check that EBDA pointer is in valid memory

Message ID	10171725.nUPlyArG6x@kreacher
State	New
Headers	show Return-Path: <linux-acpi-owner@kernel.org> From: "Rafael J. Wysocki" <rjw@rjwysocki.net> To: Linux ACPI <linux-acpi@vger.kernel.org> Cc: LKML <linux-kernel@vger.kernel.org>, Bob Moore <robert.moore@intel.com> Subject: [PATCH 03/11] ACPICA: Check that EBDA pointer is in valid memory Date: Thu, 27 Oct 2022 19:50:06 +0200 Message-ID: <10171725.nUPlyArG6x@kreacher> In-Reply-To: <4756726.GXAFRqVoOG@kreacher> References: <4756726.GXAFRqVoOG@kreacher> MIME-Version: 1.0 Content-Transfer-Encoding: 7Bit Content-Type: text/plain; charset="UTF-8" Precedence: bulk
Series	ACPICA: Upstream changes since ACPICA 20220331 \| expand [00/11] ACPICA: Upstream changes since ACPICA 20220331 [01/11] ACPICA: MADT: Add loong_arch-specific APICs support [02/11] ACPICA: Events: Support fixed PCIe wake event [03/11] ACPICA: Check that EBDA pointer is in valid memory [04/11] ACPICA: Do not touch VGA memory when EBDA < 1ki_b [05/11] ACPICA: iASL: Add CCEL table to both compiler/disassembler [06/11] ACPICA: Add a couple of new UUIDs to the known UUID list [07/11] ACPICA: Add support for FFH Opregion special context data [08/11] ACPICA: Improve warning message for "invalid ACPI name" [09/11] ACPICA: Add CXL 3.0 structures (CXIMS & RDPAS) to the CEDT table [10/11] ACPICA: IORT: Update for revision E.e [11/11] ACPICA: Finish support for the CDAT table

Message ID

10171725.nUPlyArG6x@kreacher

State

New

Headers

From: "Rafael J. Wysocki" <rjw@rjwysocki.net>
To: Linux ACPI <linux-acpi@vger.kernel.org>
Cc: LKML <linux-kernel@vger.kernel.org>,
        Bob Moore <robert.moore@intel.com>
Subject: [PATCH 03/11] ACPICA: Check that EBDA pointer is in valid memory
Date: Thu, 27 Oct 2022 19:50:06 +0200
Message-ID: <10171725.nUPlyArG6x@kreacher>
In-Reply-To: <4756726.GXAFRqVoOG@kreacher>
References: <4756726.GXAFRqVoOG@kreacher>
MIME-Version: 1.0
Content-Transfer-Encoding: 7Bit
Content-Type: text/plain; charset="UTF-8"
Precedence: bulk

Series

ACPICA: Upstream changes since ACPICA 20220331 | expand

Commit Message

Rafael J. Wysocki Oct. 27, 2022, 5:50 p.m. UTC

From: Vit Kabele <vit@kabele.me>

ACPICA commit cc9e7763ceb2e2649fe3422130416d84a3c6854a

If the memory at 0x40e is uninitialized, the retrieved physical_memory
address of EBDA may be beyond the low memory (i.e. above 640K).

If so, the kernel may unintentionally access the VGA memory, that
might not be decoded or even present in case of virtualization.

Link: https://github.com/acpica/acpica/commit/cc9e7763
Signed-off-by: Vit Kabele <vit@kabele.me>
Signed-off-by: Bob Moore <robert.moore@intel.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
---
 drivers/acpi/acpica/tbxfroot.c |    6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

Index: linux-pm/drivers/acpi/acpica/tbxfroot.c
===================================================================
--- linux-pm.orig/drivers/acpi/acpica/tbxfroot.c
+++ linux-pm/drivers/acpi/acpica/tbxfroot.c
@@ -139,7 +139,11 @@  acpi_find_root_pointer(acpi_physical_add
 
 	/* EBDA present? */
 
-	if (physical_address > 0x400) {
+	/*
+	 * Check that the EBDA pointer from memory is sane and does not point
+	 * above valid low memory
+	 */
+	if (physical_address > 0x400 && physical_address < 0xA0000) {
 		/*
 		 * 1b) Search EBDA paragraphs (EBDA is required to be a
 		 *     minimum of 1K length)

[03/11] ACPICA: Check that EBDA pointer is in valid memory

Commit Message

Patch