Rishabh Bhatnagar 422b3db2a5 firmware: Fix security issue with request_firmware_into_buf() ... When calling request_firmware_into_buf() with the FW_OPT_NOCACHE flag it is expected that firmware is loaded into buffer from memory. But inside alloc_lookup_fw_priv every new firmware that is loaded is added to the firmware cache (fwc) list head. So if any driver requests a firmware that is already loaded the code iterates over the above mentioned list and it can end up giving a pointer to other device driver's firmware buffer. Also the existing copy may either be modified by drivers, remote processors or even freed. This causes a potential security issue with batched requests when using request_firmware_into_buf. Fix alloc_lookup_fw_priv to not add to the fwc head list if FW_OPT_NOCACHE is set, and also don't do the lookup in the list. Fixes: 0e742e9275 ("firmware: provide infrastructure to make fw caching optional") [mcgrof: broken since feature introduction on v4.8] Cc: stable@vger.kernel.org # v4.8+ Signed-off-by: Vikram Mulukutla <markivx@codeaurora.org> Signed-off-by: Rishabh Bhatnagar <rishabhb@codeaurora.org> Signed-off-by: Luis Chamberlain <mcgrof@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2018-09-12 09:31:00 +02:00
..
firmware_loader	firmware: Fix security issue with request_firmware_into_buf()	2018-09-12 09:31:00 +02:00
power	PM / clk: signedness bug in of_pm_clk_add_clks()	2018-08-24 11:52:34 +02:00
regmap
test
arch_topology.c
attribute_container.c
base.h
bus.c
cacheinfo.c
class.c
component.c
container.c
core.c
cpu.c
dd.c
devcon.c
devcoredump.c
devres.c
devtmpfs.c
driver.c
firmware.c
hypervisor.c
init.c
isa.c
Kconfig
Makefile
map.c
memory.c	memory_hotplug: fix kernel_panic on offline page processing	2018-09-04 16:45:02 -07:00
module.c
node.c
pinctrl.c
platform-msi.c
platform.c
property.c
soc.c
syscore.c
topology.c
transport_class.c