Commit d3086227 authored by Yang Yingliang's avatar Yang Yingliang
Browse files

kexec/uefi: copy secure_boot flag in boot params across kexec reboot 



hulk inclusion
category: bugfix
bugzilla: NA
CVE: CVE-2015-7837

---------------------------

Kexec reboot in case secure boot being enabled does not keep the secure
boot mode in new kernel, so later one can load unsigned kernel via legacy
kexec_load.  In this state, the system is missing the protections provided
by secure boot. Adding a patch to fix this by retain the secure_boot flag
in original kernel.

secure_boot flag in boot_params is set in EFI stub, but kexec bypasses the
stub. Fixing this issue by copying secure_boot flag across kexec reboot.

Signed-off-by: default avatarYang Yingliang <yangyingliang@huawei.com>
Reviewed-by: default avatarJason Yan <yanaijie@huawei.com>
Signed-off-by: default avatarYang Yingliang <yangyingliang@huawei.com>
parent 5834b79b

arch/x86/kernel/kexec-bzimage64.c

+1 −0
Original line number Diff line number Diff line
@@ -182,6 +182,7 @@ setup_efi_state(struct boot_params *params, unsigned long params_load_addr, 
	if (efi_enabled(EFI_OLD_MEMMAP))

		return 0;



	params->secure_boot = boot_params.secure_boot;

	ei->efi_loader_signature = current_ei->efi_loader_signature;

	ei->efi_systab = current_ei->efi_systab;

	ei->efi_systab_hi = current_ei->efi_systab_hi;