mirror of
https://github.com/torvalds/linux.git
synced 2026-10-07 05:31:08 -04:00
Rishabh Bhatnagar
422b3db2a5
When calling request_firmware_into_buf() with the FW_OPT_NOCACHE flag
it is expected that firmware is loaded into buffer from memory.
But inside alloc_lookup_fw_priv every new firmware that is loaded is
added to the firmware cache (fwc) list head. So if any driver requests
a firmware that is already loaded the code iterates over the above
mentioned list and it can end up giving a pointer to other device driver's
firmware buffer.
Also the existing copy may either be modified by drivers, remote processors
or even freed. This causes a potential security issue with batched requests
when using request_firmware_into_buf.
Fix alloc_lookup_fw_priv to not add to the fwc head list if FW_OPT_NOCACHE
is set, and also don't do the lookup in the list.
Fixes: 0e742e9275 ("firmware: provide infrastructure to make fw caching optional")
[mcgrof: broken since feature introduction on v4.8]
Cc: [email protected] # v4.8+
Signed-off-by: Vikram Mulukutla <[email protected]>
Signed-off-by: Rishabh Bhatnagar <[email protected]>
Signed-off-by: Luis Chamberlain <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>