lkml.org 
[lkml]   [2018]   [Aug]   [2]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
Date
SubjectRe: [PATCH] firmware: Fix security issue with request_firmware_into_buf()
<div dir="auto"><div><br><br><div class="gmail_quote"><div dir="ltr">On Wed, Aug 1, 2018, 4:26 PM Rishabh Bhatnagar &lt;<a href="mailto:rishabhb@codeaurora.org">rishabhb@codeaurora.org</a>&gt; wrote:<br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">When calling request_firmware_into_buf() with the FW_OPT_NOCACHE flag<br>
it is expected that firmware is loaded into buffer from memory.<br>
But inside alloc_lookup_fw_priv every new firmware that is loaded is<br>
added to the firmware cache (fwc) list head. So if any driver requests<br>
a firmware that is already loaded the code iterates over the above<br>
mentioned list and it can end up giving a pointer to other device driver&#39;s<br>
firmware buffer.<br>
Also the existing copy may either be modified by drivers, remote processors<br>
or even freed. This causes a potential security issue with batched requests<br>
when using request_firmware_into_buf.<br>
<br>
Fix alloc_lookup_fw_priv to not add to the fwc head list if FW_OPT_NOCACHE<br>
is set, and also don&#39;t do the lookup in the list.<br>
<br>
Fixes: 0e742e9275 (&quot;firmware: provide infrastructure to make fw caching optional&quot;)<br>
<br>
Signed-off-by: Vikram Mulukutla &lt;<a href="mailto:markivx@codeaurora.org" target="_blank" rel="noreferrer">markivx@codeaurora.org</a>&gt;<br>
Signed-off-by: Rishabh Bhatnagar &lt;<a href="mailto:rishabhb@codeaurora.org" target="_blank" rel="noreferrer">rishabhb@codeaurora.org</a>&gt;<br>
---</blockquote></div></div><div dir="auto"><br></div><div dir="auto">Did you test with the tools/testing/selftests/firmware/ scripts? If not please do so and report back and confirm no regressions are found.</div><div dir="auto"><br></div><div dir="auto">Brownie points for you to add a test case to show the issue highlighted in this patch, and which it fixes. I believe this fix should be pushed to stable, so I&#39;ll do that after you confirm no regressions were found.</div><div dir="auto"><br></div><div dir="auto">The new selftests changed you&#39;d make would not go to stable, however there are Linux distributions and 0day that test the latest tools directory against older kernels. So this test would help capture gaps later.</div><div dir="auto"><br></div><div dir="auto">  Luis</div><div dir="auto"></div></div>
\
 
 \ /
  Last update: 2018-08-02 23:59    [W:0.048 / U:0.164 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site