Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752547AbdF2LU2 (ORCPT ); Thu, 29 Jun 2017 07:20:28 -0400 Received: from mga07.intel.com ([134.134.136.100]:42096 "EHLO mga07.intel.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751725AbdF2LUY (ORCPT ); Thu, 29 Jun 2017 07:20:24 -0400 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.40,280,1496127600"; d="scan'208";a="1146046020" From: Mika Westerberg To: Greg Kroah-Hartman Cc: Andreas Noever , Michael Jamet , Yehezkel Bernat , Mika Westerberg , linux-kernel@vger.kernel.org Subject: [PATCH] thunderbolt: Correct access permissions for active NVM contents Date: Thu, 29 Jun 2017 14:19:50 +0300 Message-Id: <20170629111950.8872-1-mika.westerberg@linux.intel.com> X-Mailer: git-send-email 2.11.0 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1537 Lines: 49 Firmware upgrade tools that decide which NVM image should be uploaded to the Thunderbolt controller need to access active parts of the NVM even if they are not run as root. The information in active NVM is not considered security critical so we can use the default permissions set by the NVMem framework. Writing the NVM image is still left as root only operation. While there mark the active NVM as read-only in the filesystem. Reported-by: Yehezkel Bernat Signed-off-by: Mika Westerberg --- Hi, This applies on top of my Thunderbolt patches in Greg's char-misc-next branch. Thanks. drivers/thunderbolt/switch.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/thunderbolt/switch.c b/drivers/thunderbolt/switch.c index ab3e8f410444..40219a706309 100644 --- a/drivers/thunderbolt/switch.c +++ b/drivers/thunderbolt/switch.c @@ -281,9 +281,11 @@ static struct nvmem_device *register_nvmem(struct tb_switch *sw, int id, if (active) { config.name = "nvm_active"; config.reg_read = tb_switch_nvm_read; + config.read_only = true; } else { config.name = "nvm_non_active"; config.reg_write = tb_switch_nvm_write; + config.root_only = true; } config.id = id; @@ -292,7 +294,6 @@ static struct nvmem_device *register_nvmem(struct tb_switch *sw, int id, config.size = size; config.dev = &sw->dev; config.owner = THIS_MODULE; - config.root_only = true; config.priv = sw; return nvmem_register(&config); -- 2.11.0