https://github.com/torvalds/linux
Revision 422b3db2a5036add39a82425b1dd9fb6c96481e8 authored by Rishabh Bhatnagar on 31 August 2018, 15:43:31 UTC, committed by Greg Kroah-Hartman on 12 September 2018, 07:31:00 UTC
When calling request_firmware_into_buf() with the FW_OPT_NOCACHE flag it is expected that firmware is loaded into buffer from memory. But inside alloc_lookup_fw_priv every new firmware that is loaded is added to the firmware cache (fwc) list head. So if any driver requests a firmware that is already loaded the code iterates over the above mentioned list and it can end up giving a pointer to other device driver's firmware buffer. Also the existing copy may either be modified by drivers, remote processors or even freed. This causes a potential security issue with batched requests when using request_firmware_into_buf. Fix alloc_lookup_fw_priv to not add to the fwc head list if FW_OPT_NOCACHE is set, and also don't do the lookup in the list. Fixes: 0e742e9275 ("firmware: provide infrastructure to make fw caching optional") [mcgrof: broken since feature introduction on v4.8] Cc: stable@vger.kernel.org # v4.8+ Signed-off-by: Vikram Mulukutla <markivx@codeaurora.org> Signed-off-by: Rishabh Bhatnagar <rishabhb@codeaurora.org> Signed-off-by: Luis Chamberlain <mcgrof@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
1 parent 6712cc9
Tip revision: 422b3db2a5036add39a82425b1dd9fb6c96481e8 authored by Rishabh Bhatnagar on 31 August 2018, 15:43:31 UTC
firmware: Fix security issue with request_firmware_into_buf()
firmware: Fix security issue with request_firmware_into_buf()
Tip revision: 422b3db
File | Mode | Size |
---|---|---|
Documentation | ||
LICENSES | ||
arch | ||
block | ||
certs | ||
crypto | ||
drivers | ||
firmware | ||
fs | ||
include | ||
init | ||
ipc | ||
kernel | ||
lib | ||
mm | ||
net | ||
samples | ||
scripts | ||
security | ||
sound | ||
tools | ||
usr | ||
virt | ||
.clang-format | -rw-r--r-- | 12.8 KB |
.cocciconfig | -rw-r--r-- | 59 bytes |
.get_maintainer.ignore | -rw-r--r-- | 31 bytes |
.gitattributes | -rw-r--r-- | 30 bytes |
.gitignore | -rw-r--r-- | 1.5 KB |
.mailmap | -rw-r--r-- | 9.7 KB |
COPYING | -rw-r--r-- | 423 bytes |
CREDITS | -rw-r--r-- | 96.4 KB |
Kbuild | -rw-r--r-- | 2.2 KB |
Kconfig | -rw-r--r-- | 563 bytes |
MAINTAINERS | -rw-r--r-- | 458.5 KB |
Makefile | -rw-r--r-- | 59.1 KB |
README | -rw-r--r-- | 800 bytes |
Computing file changes ...