From 693b3d6fd677a0ff7206f9f4edb2e5eef1a89fdf Mon Sep 17 00:00:00 2001 From: Jiri Kosina Date: Fri, 5 Jan 2018 11:21:38 -0800 Subject: [PATCH] PTI: unbreak EFI old_memmap old_memmap's efi_call_phys_prolog() calls set_pgd() with swapper PGD that has PAGE_USER set, which makes PTI set NX on it, and therefore EFI can't execute it's code. Fix that by forcefully clearing _PAGE_NX from the PGD (this can't be done by the pgprot API). _PAGE_NX will be automatically reintroduced in efi_call_phys_epilog(), as _set_pgd() will again notice that this is _PAGE_USER, and set _PAGE_NX on it. Signed-off-by: Jiri Kosina Orabug: 27333760 CVE: CVE-2017-5754 Signed-off-by: Pavel Tatashin Signed-off-by: Kirtikar Kashyap --- arch/x86/platform/efi/efi_64.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/arch/x86/platform/efi/efi_64.c b/arch/x86/platform/efi/efi_64.c index a0ac0f9c307f6..3327c3155a9f4 100644 --- a/arch/x86/platform/efi/efi_64.c +++ b/arch/x86/platform/efi/efi_64.c @@ -95,6 +95,12 @@ pgd_t * __init efi_call_phys_prolog(void) save_pgd[pgd] = *pgd_offset_k(pgd * PGDIR_SIZE); vaddress = (unsigned long)__va(pgd * PGDIR_SIZE); set_pgd(pgd_offset_k(pgd * PGDIR_SIZE), *pgd_offset_k(vaddress)); + /* + * pgprot API doesn't clear it for PGD + * + * Will be brought back automatically in _epilog() + */ + pgd_offset_k(pgd * PGDIR_SIZE)->pgd &= ~_PAGE_NX; } __flush_tlb_all(); -- 2.50.1