No description
  • C 98.2%
  • Assembly 1%
  • Makefile 0.3%
  • Shell 0.2%
  • Python 0.1%
Find a file
Repository files (latest commit first)
Filename Latest commit message Latest commit date
Thiébaud Weksteen b38cf3cb17 firmware_loader: use kernel credentials when reading firmware
commit 581dd69830341d299b0c097fc366097ab497d679 upstream.

Device drivers may decide to not load firmware when probed to avoid
slowing down the boot process should the firmware filesystem not be
available yet. In this case, the firmware loading request may be done
when a device file associated with the driver is first accessed. The
credentials of the userspace process accessing the device file may be
used to validate access to the firmware files requested by the driver.
Ensure that the kernel assumes the responsibility of reading the
firmware.

This was observed on Android for a graphic driver loading their firmware
when the device file (e.g. /dev/mali0) was first opened by userspace
(i.e. surfaceflinger). The security context of surfaceflinger was used
to validate the access to the firmware file (e.g.
/vendor/firmware/mali.bin).

Previously, Android configurations were not setting up the
firmware_class.path command line argument and were relying on the
userspace fallback mechanism. In this case, the security context of the
userspace daemon (i.e. ueventd) was consistently used to read firmware
files. More Android devices are now found to set firmware_class.path
which gives the kernel the opportunity to read the firmware directly
(via kernel_read_file_from_path_initns). In this scenario, the current
process credentials were used, even if unrelated to the loading of the
firmware file.

Signed-off-by: Thiébaud Weksteen <tweek@google.com>
Cc: <stable@vger.kernel.org> # 5.10
Reviewed-by: Paul Moore <paul@paul-moore.com>
Acked-by: Luis Chamberlain <mcgrof@kernel.org>
Link: https://lore.kernel.org/r/20220502004952.3970800-1-tweek@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-05-25 09:14:38 +02:00
arch ARM: 9197/1: spectre-bhb: fix loop8 sequence for Thumb2 2022-05-25 09:14:36 +02:00
block block: return ELEVATOR_DISCARD_MERGE if possible 2022-05-25 09:14:38 +02:00
certs certs: Trigger creation of RSA module signing key if it's not an RSA key 2021-09-15 09:47:29 +02:00
crypto crypto: authenc - Fix sleep in atomic context in decrypt_tail 2022-04-15 14:18:04 +02:00
Documentation arm: remove CONFIG_ARCH_HAS_HOLES_MEMORYMODEL 2022-05-15 19:54:46 +02:00
drivers firmware_loader: use kernel credentials when reading firmware 2022-05-25 09:14:38 +02:00
fs SUNRPC: Ensure we flush any closed sockets before xs_xprt_free() 2022-05-25 09:14:34 +02:00
include net: stmmac: disable Split Header (SPH) for Intel platforms 2022-05-25 09:14:38 +02:00
init init/main.c: return 1 from handled __setup() functions 2022-04-15 14:18:35 +02:00
ipc shm: extend forced shm destroy to support objects from several IPC nses 2021-12-01 09:23:35 +01:00
kernel perf: Fix sys_perf_event_open() race against self 2022-05-25 09:14:34 +02:00
lib dim: initialize all struct fields 2022-05-18 09:47:25 +02:00
LICENSES
mm mm: userfaultfd: fix missing cache flush in mcopy_atomic_pte() and __mcopy_atomic() 2022-05-15 19:54:47 +02:00
net mac80211: fix rx reordering with non explicit / psmp ack policy 2022-05-25 09:14:37 +02:00
samples samples/kretprobes: Fix return value if register_kretprobe() failed 2021-11-17 09:48:39 +01:00
scripts gcc-plugins: latent_entropy: use /dev/urandom 2022-04-20 09:19:38 +02:00
security Fix incorrect type in assignment of ipv6 port for audit 2022-04-15 14:18:22 +02:00
sound ALSA: wavefront: Proper check of get_user() error 2022-05-25 09:14:34 +02:00
tools selftests: add ping test with ping_group_range tuned 2022-05-25 09:14:37 +02:00
usr initramfs: restore default compression behavior 2020-04-08 09:08:38 +02:00
virt KVM: Prevent module exit until all VMs are freed 2022-04-15 14:18:27 +02:00
.clang-format
.cocciconfig
.get_maintainer.ignore
.gitattributes
.gitignore
.mailmap
COPYING
CREDITS
Kbuild
Kconfig
MAINTAINERS Documentation/llvm: add documentation on building w/ Clang/LLVM 2020-08-26 10:40:46 +02:00
Makefile Linux 5.4.195 2022-05-18 09:47:28 +02:00
README

Linux kernel
============

There are several guides for kernel developers and users. These guides can
be rendered in a number of formats, like HTML and PDF. Please read
Documentation/admin-guide/README.rst first.

In order to build the documentation, use ``make htmldocs`` or
``make pdfdocs``.  The formatted documentation can also be read online at:

    https://www.kernel.org/doc/html/latest/

There are various text files in the Documentation/ subdirectory,
several of them using the Restructured Text markup notation.

Please read the Documentation/process/changes.rst file, as it contains the
requirements for building and running the kernel, and information about
the problems which may result by upgrading your kernel.