Re: [PATCH] x86/ima: Check EFI_RUNTIME_SERVICES before using

[Mimi Zohar <zohar@xxxxxxxxxxxxx>]

On Tue, 2019-04-23 at 17:48 -0500, Scott Wood wrote:
> Checking efi_enabled(EFI_BOOT) is not sufficient to ensure that
> EFI runtime services are available, e.g. if efi=noruntime is used.
> 
> Without this, I get an oops on a PREEMPT_RT kernel where efi=noruntime is
> the default.
> 
> Fixes: 399574c64eaf94e8 ("x86/ima: retry detecting secure boot mode")
> Signed-off-by: Scott Wood <swood@xxxxxxxxxx>

Thanks!

> ---
>  arch/x86/kernel/ima_arch.c | 5 +++++
>  1 file changed, 5 insertions(+)
> 
> diff --git a/arch/x86/kernel/ima_arch.c b/arch/x86/kernel/ima_arch.c
> index e47cd9390ab4..2a2e87717bad 100644
> --- a/arch/x86/kernel/ima_arch.c
> +++ b/arch/x86/kernel/ima_arch.c
> @@ -17,6 +17,11 @@ static enum efi_secureboot_mode get_sb_mode(void)
>  
>  	size = sizeof(secboot);
>  
> +	if (!efi_enabled(EFI_RUNTIME_SERVICES)) {
> +		pr_info("ima: secureboot mode unknown, no efi\n");
> +		return efi_secureboot_mode_unknown;
> +	}
> +
>  	/* Get variable contents into buffer */
>  	status = efi.get_variable(efi_SecureBoot_name, &efi_variable_guid,
>  				  NULL, &size, &secboot);