linux_dsm_epyc7002/drivers/base
Rishabh Bhatnagar 422b3db2a5 firmware: Fix security issue with request_firmware_into_buf()
When calling request_firmware_into_buf() with the FW_OPT_NOCACHE flag
it is expected that firmware is loaded into buffer from memory.
But inside alloc_lookup_fw_priv every new firmware that is loaded is
added to the firmware cache (fwc) list head. So if any driver requests
a firmware that is already loaded the code iterates over the above
mentioned list and it can end up giving a pointer to other device driver's
firmware buffer.
Also the existing copy may either be modified by drivers, remote processors
or even freed. This causes a potential security issue with batched requests
when using request_firmware_into_buf.

Fix alloc_lookup_fw_priv to not add to the fwc head list if FW_OPT_NOCACHE
is set, and also don't do the lookup in the list.

Fixes: 0e742e9275 ("firmware: provide infrastructure to make fw caching optional")
[mcgrof: broken since feature introduction on v4.8]

Cc: stable@vger.kernel.org # v4.8+
Signed-off-by: Vikram Mulukutla <markivx@codeaurora.org>
Signed-off-by: Rishabh Bhatnagar <rishabhb@codeaurora.org>
Signed-off-by: Luis Chamberlain <mcgrof@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-09-12 09:31:00 +02:00
..
firmware_loader firmware: Fix security issue with request_firmware_into_buf() 2018-09-12 09:31:00 +02:00
power PM / clk: signedness bug in of_pm_clk_add_clks() 2018-08-24 11:52:34 +02:00
regmap
test
arch_topology.c
attribute_container.c
base.h
bus.c
cacheinfo.c
class.c
component.c
container.c
core.c Driver core patches for 4.19-rc1 2018-08-18 11:44:53 -07:00
cpu.c
dd.c
devcon.c
devcoredump.c
devres.c
devtmpfs.c
driver.c
firmware.c
hypervisor.c
init.c
isa.c
Kconfig
Makefile
map.c
memory.c memory_hotplug: fix kernel_panic on offline page processing 2018-09-04 16:45:02 -07:00
module.c
node.c mm/memory_hotplug.c: drop unnecessary checks from register_mem_sect_under_node() 2018-08-17 16:20:29 -07:00
pinctrl.c
platform-msi.c
platform.c
property.c
soc.c
syscore.c
topology.c
transport_class.c