From:   Matthew Garrett <matthewgarrett@google.com>
Date:   Mon, 25 Mar 2019 15:09:43 -0700
Subject: [PATCH 16/27] acpi: Disable APEI error injection if the kernel is
 locked down
Patch-mainline: Never, SUSE specific tweak 
References: bsc#1023051, CVE-2016-3695

From: Linn Crosetto <linn@hpe.com>

ACPI provides an error injection mechanism, EINJ, for debugging and testing
the ACPI Platform Error Interface (APEI) and other RAS features.  If
supported by the firmware, ACPI specification 5.0 and later provide for a
way to specify a physical memory address to which to inject the error.

Injecting errors through EINJ can produce errors which to the platform are
indistinguishable from real hardware errors.  This can have undesirable
side-effects, such as causing the platform to mark hardware as needing
replacement.

While it does not provide a method to load unauthenticated privileged code,
the effect of these errors may persist across reboots and affect trust in
the underlying hardware, so disable error injection through EINJ if
the kernel is locked down.

Joey Lee:
To avoid kABI change, borrow LOCKDOWN_ACPI_TABLES and modify the
lockdown reason string.  

Signed-off-by: Linn Crosetto <linn@hpe.com>
Signed-off-by: David Howells <dhowells@redhat.com>
cc: linux-acpi@vger.kernel.org
Signed-off-by: Matthew Garrett <matthewgarrett@google.com>
Acked-by: Lee, Chun-Yi <jlee@suse.com>
---
 drivers/acpi/apei/einj.c |    4 ++++
 security/security.c      |    2 +-
 2 files changed, 5 insertions(+), 1 deletion(-)

--- a/drivers/acpi/apei/einj.c
+++ b/drivers/acpi/apei/einj.c
@@ -21,6 +21,7 @@
 #include <linux/nmi.h>
 #include <linux/delay.h>
 #include <linux/mm.h>
+#include <linux/security.h>
 #include <asm/unaligned.h>
 
 #include "apei-internal.h"
@@ -510,6 +511,9 @@ static int einj_error_inject(u32 type, u
 	int rc;
 	u64 base_addr, size;
 
+	if (security_locked_down(LOCKDOWN_ACPI_TABLES))
+		return -EPERM;
+
 	/* If user manually set "flags", make sure it is legal */
 	if (flags && (flags &
 		~(SETWA_FLAGS_APICID|SETWA_FLAGS_MEM|SETWA_FLAGS_PCIE_SBDF)))
--- a/security/security.c
+++ b/security/security.c
@@ -51,7 +51,7 @@ const char *const lockdown_reasons[LOCKD
 	[LOCKDOWN_PCI_ACCESS] = "direct PCI access",
 	[LOCKDOWN_IOPORT] = "raw io port access",
 	[LOCKDOWN_MSR] = "raw MSR access",
-	[LOCKDOWN_ACPI_TABLES] = "modifying ACPI tables",
+	[LOCKDOWN_ACPI_TABLES] = "modifying ACPI tables or ACPI error injection",
 	[LOCKDOWN_PCMCIA_CIS] = "direct PCMCIA CIS storage",
 	[LOCKDOWN_TIOCSSERIAL] = "reconfiguration of serial port IO",
 	[LOCKDOWN_MODULE_PARAMETERS] = "unsafe module parameters",