[PATCH 1/2 v2] efivarfs: Validate filenames much more aggressively

2013-02-12 Thread Matt Fleming
The only thing that efivarfs does to enforce a valid filename is ensure that the name isn't too short. We need to strongly sanitise any filenames, not least because variable creation is delayed until efivarfs_file_write(), which means we can't rely on the firmware to inform us of an invalid name,

Re: [PATCH V3] ia64/mm: fix a bad_page bug when crash kernel booting

2013-02-12 Thread Andrew Morton
On Tue, 12 Feb 2013 16:11:33 -0800 Tony Luck tony.l...@gmail.com wrote: Building linux-next today (tag next-20130212) I get the following errors when building arch/ia64/configs/{tiger_defconfig, zx1_defconfig, bigsur_defconfig, sim_defconfig} arch/ia64/mm/init.c: In function

Re: [PATCH V3] ia64/mm: fix a bad_page bug when crash kernel booting

2013-02-12 Thread Andrew Morton
On Tue, 12 Feb 2013 16:11:33 -0800 Tony Luck tony.l...@gmail.com wrote: Building linux-next today (tag next-20130212) I get the following errors when building arch/ia64/configs/{tiger_defconfig, zx1_defconfig, bigsur_defconfig, sim_defconfig} arch/ia64/mm/init.c: In function

Re: [PATCH] x86: Lock down MSR writing in secure boot

2013-02-12 Thread Matthew Garrett
On Tue, 2013-02-12 at 22:12 -0800, H. Peter Anvin wrote: Sounds like you are thinking of CAP_SYS_ADMIN, but I don't really see a huge difference between MSRs and I/O control registers... just different address spaces. Not having CAP_SYS_RAWIO blocks various SCSI commands, for instance.

Re: [PATCH] x86: Lock down MSR writing in secure boot

2013-02-12 Thread Matthew Garrett
On Tue, 2013-02-12 at 22:33 -0800, H. Peter Anvin wrote: That is just batshit crazy. If you have CAP_SYS_RAWIO you can do iopl() which means you can reprogram your northbridge, at which point you most definitely *can* modify the running kernel. Well right, that's the point of this patchset

Re: [PATCH 1/3 v3] selftests: Add tests for efivarfs

2013-02-12 Thread Matt Fleming
On Tue, 2013-02-12 at 15:50 -0800, Andrew Morton wrote: On Fri, 08 Feb 2013 10:08:49 + Matt Fleming matt.flem...@intel.com wrote: On Fri, 2013-02-08 at 18:05 +0800, Jeremy Kerr wrote: However, the tests expose a bug at the moment, so run_tests will fail. Matt will have that fixed