Messages in this thread Patch in this message | | | From | Ming Lei <> | Subject | [RFC PATCH v1 4/4] firmware loader: don't allow to request firmware via relative path | Date | Thu, 6 Jun 2013 20:01:50 +0800 |
| |
It isn't a good pratice to request firmware via relative path, also might have security issue, so don't do it.
Cc: Takashi Iwai <tiwai@suse.de> Signed-off-by: Ming Lei <ming.lei@canonical.com> --- drivers/base/firmware_class.c | 11 +++++++++++ 1 file changed, 11 insertions(+)
diff --git a/drivers/base/firmware_class.c b/drivers/base/firmware_class.c index 051db83..d381db9 100644 --- a/drivers/base/firmware_class.c +++ b/drivers/base/firmware_class.c @@ -356,6 +356,10 @@ static bool fw_get_file_fw_from_paths(const char *paths, char *path, strncpy(path, &paths[start], len); snprintf(&path[len], PATH_MAX - len, "/%s", buf->fw_id); + /* relative path isn't allowed */ + if (strstr(path, "../")) + continue; + if (fw_get_file_firmware(path, buf)) return true; } while (pos && end < strlen(paths) - 1); @@ -1031,6 +1035,13 @@ _request_firmware_prepare(struct firmware **firmware_p, const char *name, return 0; /* assigned */ } + /* relative path isn't allowed */ + if (strstr(name, "../")) { + dev_err(device, "%s: relative path isn't allowed\n", + name); + return -EINVAL; + } + ret = fw_lookup_and_allocate_buf(name, &fw_cache, &buf); /* -- 1.7.9.5
| |