Rishabh Bhatnagar 422b3db2a5 firmware: Fix security issue with request_firmware_into_buf() ... When calling request_firmware_into_buf() with the FW_OPT_NOCACHE flag it is expected that firmware is loaded into buffer from memory. But inside alloc_lookup_fw_priv every new firmware that is loaded is added to the firmware cache (fwc) list head. So if any driver requests a firmware that is already loaded the code iterates over the above mentioned list and it can end up giving a pointer to other device driver's firmware buffer. Also the existing copy may either be modified by drivers, remote processors or even freed. This causes a potential security issue with batched requests when using request_firmware_into_buf. Fix alloc_lookup_fw_priv to not add to the fwc head list if FW_OPT_NOCACHE is set, and also don't do the lookup in the list. Fixes: 0e742e9275 ("firmware: provide infrastructure to make fw caching optional") [mcgrof: broken since feature introduction on v4.8] Cc: stable@vger.kernel.org # v4.8+ Signed-off-by: Vikram Mulukutla <markivx@codeaurora.org> Signed-off-by: Rishabh Bhatnagar <rishabhb@codeaurora.org> Signed-off-by: Luis Chamberlain <mcgrof@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2018-09-12 09:31:00 +02:00
..
fallback_table.c	firmware: enable to force disable the fallback mechanism at run time	2018-03-20 09:28:47 +01:00
fallback.c	mm: provide a fallback for PAGE_KERNEL_RO for architectures	2018-08-17 16:20:29 -07:00
fallback.h	firmware: rename fw_sysfs_fallback to firmware_fallback_sysfs()	2018-05-14 16:43:09 +02:00
firmware.h	firmware: rename fw_sysfs_fallback to firmware_fallback_sysfs()	2018-05-14 16:43:09 +02:00
Kconfig	firmware_loader: move kconfig FW_LOADER entries to its own file	2018-05-14 16:43:10 +02:00
main.c	firmware: Fix security issue with request_firmware_into_buf()	2018-09-12 09:31:00 +02:00
Makefile