diff options
| author | Ard Biesheuvel <ardb@kernel.org> | 2020-09-26 11:52:42 +0300 |
|---|---|---|
| committer | Ard Biesheuvel <ardb@kernel.org> | 2020-09-29 16:41:52 +0300 |
| commit | d32de9130f6c79533508e2c7879f18997bfbe2a0 (patch) | |
| tree | 84b20813ae0a652d65300c70318746a6a3e27063 /drivers/firmware/efi/libstub/fdt.c | |
| parent | 336af6a4686d885a067ecea8c3c3dd129ba4fc75 (diff) | |
| download | linux-d32de9130f6c79533508e2c7879f18997bfbe2a0.tar.xz | |
efi/arm64: libstub: Deal gracefully with EFI_RNG_PROTOCOL failure
Currently, on arm64, we abort on any failure from efi_get_random_bytes()
other than EFI_NOT_FOUND when it comes to setting the physical seed for
KASLR, but ignore such failures when obtaining the seed for virtual
KASLR or for early seeding of the kernel's entropy pool via the config
table. This is inconsistent, and may lead to unexpected boot failures.
So let's permit any failure for the physical seed, and simply report
the error code if it does not equal EFI_NOT_FOUND.
Cc: <stable@vger.kernel.org> # v5.8+
Reported-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
Diffstat (limited to 'drivers/firmware/efi/libstub/fdt.c')
| -rw-r--r-- | drivers/firmware/efi/libstub/fdt.c | 4 |
1 files changed, 1 insertions, 3 deletions
diff --git a/drivers/firmware/efi/libstub/fdt.c b/drivers/firmware/efi/libstub/fdt.c index 11ecf3c4640e..368cd60000ee 100644 --- a/drivers/firmware/efi/libstub/fdt.c +++ b/drivers/firmware/efi/libstub/fdt.c @@ -136,7 +136,7 @@ static efi_status_t update_fdt(void *orig_fdt, unsigned long orig_fdt_size, if (status) goto fdt_set_fail; - if (IS_ENABLED(CONFIG_RANDOMIZE_BASE)) { + if (IS_ENABLED(CONFIG_RANDOMIZE_BASE) && !efi_nokaslr) { efi_status_t efi_status; efi_status = efi_get_random_bytes(sizeof(fdt_val64), @@ -145,8 +145,6 @@ static efi_status_t update_fdt(void *orig_fdt, unsigned long orig_fdt_size, status = fdt_setprop_var(fdt, node, "kaslr-seed", fdt_val64); if (status) goto fdt_set_fail; - } else if (efi_status != EFI_NOT_FOUND) { - return efi_status; } } |