Skip to contentSkip to conversation

mtd: phram: Add the kernel lock down check

PATCH Applied Takashi Iwai 3 participants 3 messages Nov 14, 2024 – Dec 5, 2024

Subsystems (2)
Memory technology devices (MTD) Phram MTD driver
lore
Share & tools
lore

Takashi Iwai

author
#0 lore raw

PATCH 1/1 mtd: phram: Add the kernel lock down check

The phram MTD driver may map any memory pages no matter whether it's reserved or whatever used for systems, which basically allows user bypassing the lock down.

Add the check and abort the probe if the kernel is locked down for LOCKDOWN_DEV_MEM.

Reported-by Fabian Vogt <[email protected]>
Suggested-by Fabian Vogt <[email protected]>
Signed-off-by Takashi Iwai <[email protected]>
---
 drivers/mtd/devices/phram.c | 5 +++++
 1 file changed, 5 insertions(+)
drivers/mtd/devices/phram.c +5 -0
index 1bf192f229d7..48abfb81ef66 100644
@@ -30,6 +30,7 @@
 #include <linux/platform_device.h>
 #include <linux/of_address.h>
 #include <linux/of.h>
+#include <linux/security.h>
 
 struct phram_mtd_list {
 	struct mtd_info mtd;

@@ -410,6 +411,10 @@ static int __init init_phram(void)
 {
 	int ret;
 
+	ret = security_locked_down(LOCKDOWN_DEV_MEM);
+	if (ret)
+		return ret;
+
 	ret = platform_driver_register(&phram_driver);
 	if (ret)
 		return ret;
Signature · 1 line
2.43.0
maintainer Acked-by on v1 1/1
#1 lore raw

----- Ursprüngliche Mail -----

Quoted 11 lines

Von: "Takashi Iwai" <[email protected]>
An: "linux-mtd" <[email protected]>
CC: "joern" <[email protected]>, "Miquel Raynal" <[email protected]>, "richard" <[email protected]>, "Vignesh Raghavendra" <[email protected]>, "linux-kernel" <[email protected]>, "Fabian Vogt" <[email protected]>
Gesendet: Donnerstag, 14. November 2024 16:44:41
Betreff: [PATCH] mtd: phram: Add the kernel lock down check

The phram MTD driver may map any memory pages no matter whether it's reserved or whatever used for systems, which basically allows user bypassing the lock down.

Quoted 6 lines

Add the check and abort the probe if the kernel is locked down for LOCKDOWN_DEV_MEM.

Reported-by Fabian Vogt <[email protected]>
Suggested-by Fabian Vogt <[email protected]>
Signed-off-by Takashi Iwai <[email protected]>

Good catch!

Acked-by Richard Weinberger <[email protected]>

Thanks,
//richard

maintainer Applied
#2 lore raw
In reply to Takashi Iwai
Quoted 10 lines · Takashi Iwai

The phram MTD driver may map any memory pages no matter whether it's reserved or whatever used for systems, which basically allows user bypassing the lock down.

Add the check and abort the probe if the kernel is locked down for LOCKDOWN_DEV_MEM.

Reported-by Fabian Vogt <[email protected]>
Suggested-by Fabian Vogt <[email protected]>
Signed-off-by Takashi Iwai <[email protected]>

Applied to mtd/next.

Thanks,
Miquèl