diff options
| author | Ard Biesheuvel <ardb@kernel.org> | 2026-05-01 19:01:56 +0200 |
|---|---|---|
| committer | Kees Cook <kees@kernel.org> | 2026-05-21 03:19:47 -0700 |
| commit | a34039981e6deb0580cf3215bfda02731596eada (patch) | |
| tree | dc1154d3fd65dd407061b5cfa7913ce92395b3f2 /drivers/misc | |
| parent | 8f64fb098a5b1dfea57989fdf732b6168f0e1c35 (diff) | |
lkdtm: Add case to provoke a crash in EFI runtime services
Add a lkdtm test case that triggers a fault during the execution of a
EFI runtime service by passing a read-only variable as a by-ref argument
that the firmware is supposed to update.
This is useful for testing the graceful handling of faults/exception in
EFI platform firmware, which is implemented on x86 and arm64.
Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
Link: https://patch.msgid.link/20260501170156.2833364-2-ardb+git@google.com
Signed-off-by: Kees Cook <kees@kernel.org>
Diffstat (limited to 'drivers/misc')
| -rw-r--r-- | drivers/misc/lkdtm/bugs.c | 27 |
1 files changed, 27 insertions, 0 deletions
diff --git a/drivers/misc/lkdtm/bugs.c b/drivers/misc/lkdtm/bugs.c index e0098f314570..3eca2ef64aff 100644 --- a/drivers/misc/lkdtm/bugs.c +++ b/drivers/misc/lkdtm/bugs.c @@ -7,6 +7,7 @@ */ #include "lkdtm.h" #include <linux/cpu.h> +#include <linux/efi.h> #include <linux/list.h> #include <linux/hrtimer.h> #include <linux/sched.h> @@ -817,6 +818,29 @@ static noinline void lkdtm_CORRUPT_PAC(void) #endif } +static void __maybe_unused lkdtm_EFI_RUNTIME_CRASH(void) +{ + static unsigned long size __ro_after_init = sizeof(efi_char16_t); + efi_status_t status; + + if (!efi.get_next_variable || + !efi_enabled(EFI_RUNTIME_SERVICES) || + !efi_rt_services_supported(EFI_RT_SUPPORTED_GET_NEXT_VARIABLE_NAME)) { + pr_err("FAIL: EFI GetNextVariableName() is not available\n"); + return; + } + + /* + * Provoke a fault by asking the firmware to write to a read-only + * variable. + */ + status = efi.get_next_variable(&size, L"", &(efi_guid_t){}); + + if (status != EFI_ABORTED || efi_enabled(EFI_RUNTIME_SERVICES)) + pr_err("FAIL: EFI GetNextVariable() did not abort (%#lx)\n", + status); +} + static struct crashtype crashtypes[] = { CRASHTYPE(PANIC), CRASHTYPE(PANIC_STOP_IRQOFF), @@ -850,6 +874,9 @@ static struct crashtype crashtypes[] = { CRASHTYPE(UNSET_SMEP), CRASHTYPE(DOUBLE_FAULT), CRASHTYPE(CORRUPT_PAC), +#ifdef CONFIG_EFI + CRASHTYPE(EFI_RUNTIME_CRASH), +#endif }; struct crashtype_category bugs_crashtypes = { |