linux/drivers/base
Rishabh Bhatnagar 422b3db2a5 firmware: Fix security issue with request_firmware_into_buf()
When calling request_firmware_into_buf() with the FW_OPT_NOCACHE flag
it is expected that firmware is loaded into buffer from memory.
But inside alloc_lookup_fw_priv every new firmware that is loaded is
added to the firmware cache (fwc) list head. So if any driver requests
a firmware that is already loaded the code iterates over the above
mentioned list and it can end up giving a pointer to other device driver's
firmware buffer.
Also the existing copy may either be modified by drivers, remote processors
or even freed. This causes a potential security issue with batched requests
when using request_firmware_into_buf.

Fix alloc_lookup_fw_priv to not add to the fwc head list if FW_OPT_NOCACHE
is set, and also don't do the lookup in the list.

Fixes: 0e742e9275 ("firmware: provide infrastructure to make fw caching optional")
[mcgrof: broken since feature introduction on v4.8]

Cc: stable@vger.kernel.org # v4.8+
Signed-off-by: Vikram Mulukutla <markivx@codeaurora.org>
Signed-off-by: Rishabh Bhatnagar <rishabhb@codeaurora.org>
Signed-off-by: Luis Chamberlain <mcgrof@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-09-12 09:31:00 +02:00
..
firmware_loader firmware: Fix security issue with request_firmware_into_buf() 2018-09-12 09:31:00 +02:00
power PM / clk: signedness bug in of_pm_clk_add_clks() 2018-08-24 11:52:34 +02:00
regmap regmap: Support non-incrementing registers 2018-08-09 11:15:06 +01:00
test driver core: Remove redundant license text 2017-12-07 18:36:44 +01:00
arch_topology.c Revert "base: arch_topology: fix section mismatch build warnings" 2018-03-15 14:36:20 +01:00
attribute_container.c driver core: Remove redundant license text 2017-12-07 18:36:44 +01:00
base.h driver core: remove unnecessary function extern declare 2018-07-16 13:32:20 +02:00
bus.c driver core: hold dev's parent lock when needed 2018-05-31 10:12:07 +02:00
cacheinfo.c drivers: base: cacheinfo: use OF property_read_u32 instead of get_property,read_number 2018-07-07 17:20:47 +02:00
class.c driver core: Remove redundant license text 2017-12-07 18:36:44 +01:00
component.c component: add debugfs support 2017-12-18 16:51:11 +01:00
container.c driver core: Remove redundant license text 2017-12-07 18:36:44 +01:00
core.c Driver core patches for 4.19-rc1 2018-08-18 11:44:53 -07:00
cpu.c x86/speculation/l1tf: Add sysfs reporting for l1tf 2018-06-20 19:10:00 +02:00
dd.c Merge 4.18-rc7 into driver-core-next 2018-07-30 10:08:09 +02:00
devcon.c drivers: base: Unified device connection lookup 2018-03-22 13:10:29 +01:00
devcoredump.c driver core: Remove redundant license text 2017-12-07 18:36:44 +01:00
devres.c device: Use overflow helpers for devm_kmalloc() 2018-06-05 12:16:51 -07:00
devtmpfs.c kernel: add ksys_unshare() helper; remove in-kernel calls to sys_unshare() 2018-04-02 20:16:06 +02:00
driver.c driver-core: return EINVAL error instead of BUG_ON() 2018-05-25 18:18:45 +02:00
firmware.c driver core: Remove redundant license text 2017-12-07 18:36:44 +01:00
hypervisor.c driver core: Remove redundant license text 2017-12-07 18:36:44 +01:00
init.c base: fix order of OF initialization 2018-07-07 17:54:29 +02:00
isa.c Merge 4.15-rc3 into driver-core-next 2017-12-11 08:50:05 +01:00
Kconfig firmware_loader: move kconfig FW_LOADER entries to its own file 2018-05-14 16:43:10 +02:00
Makefile dma-mapping: move all DMA mapping code to kernel/dma 2018-06-14 08:50:37 +02:00
map.c driver core: Remove redundant license text 2017-12-07 18:36:44 +01:00
memory.c memory_hotplug: fix kernel_panic on offline page processing 2018-09-04 16:45:02 -07:00
module.c driver core: Remove redundant license text 2017-12-07 18:36:44 +01:00
node.c mm/memory_hotplug.c: drop unnecessary checks from register_mem_sect_under_node() 2018-08-17 16:20:29 -07:00
pinctrl.c driver core: Remove redundant license text 2017-12-07 18:36:44 +01:00
platform-msi.c genirq/msi: Limit level-triggered MSI to platform devices 2018-05-13 15:58:59 +02:00
platform.c Power management updates for 4.18-rc1 2018-06-05 09:38:39 -07:00
property.c device property: Get rid of union aliasing 2018-05-17 12:47:21 +02:00
soc.c base: soc: use put_device() instead of kfree() 2018-03-15 14:37:03 +01:00
syscore.c driver core: Remove redundant license text 2017-12-07 18:36:44 +01:00
topology.c driver core: Remove redundant license text 2017-12-07 18:36:44 +01:00
transport_class.c driver core: Remove redundant license text 2017-12-07 18:36:44 +01:00