Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
From:   Ioana Ciornei <ioana.ciornei@nxp.com>
To:     "gregkh@linuxfoundation.org" <gregkh@linuxfoundation.org>
CC:     Laurentiu Tudor <laurentiu.tudor@nxp.com>,
        "linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
        "netdev-owner@vger.kernel.org" <netdev-owner@vger.kernel.org>,
        Ioana Ciocoi Radulescu <ruxandra.radulescu@nxp.com>,
        Horia Geanta <horia.geanta@nxp.com>,
        Leo Li <leoyang.li@nxp.com>
Subject: RE: [PATCH v3 2/4] bus: fsl-mc: add fsl-mc userspace support
Thread-Topic: [PATCH v3 2/4] bus: fsl-mc: add fsl-mc userspace support
Thread-Index: AQHUgOdDaPiLexuoCUeDRyxH1kY+eaVY4AQAgAAPQtA=
Date:   Tue, 20 Nov 2018 17:59:26 +0000
Message-ID: <VI1PR0402MB2800989D7FB9856EA9D2A083E0D90@VI1PR0402MB2800.eurprd04.prod.outlook.com>
References: <1542728371-6972-1-git-send-email-ioana.ciornei@nxp.com>
 <1542728371-6972-3-git-send-email-ioana.ciornei@nxp.com>
 <20181120164850.GC27531@kroah.com>
In-Reply-To: <20181120164850.GC27531@kroah.com>
Accept-Language: en-US
Content-Language: en-US
received-spf: None (protection.outlook.com: nxp.com does not designate
 permitted sender hosts)
spamdiagnosticoutput: 1:99
spamdiagnosticmetadata: NSPM
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-MS-Exchange-CrossTenant-Network-Message-Id: 7fbf8263-3039-440d-e015-08d64f11e934
X-MS-Exchange-CrossTenant-originalarrivaltime: 20 Nov 2018 17:59:26.3807
 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 686ea1d3-bc2b-4c6f-a92c-d99c5c301635
X-MS-Exchange-Transport-CrossTenantHeadersStamped: VI1PR0402MB3837
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

> > +static int fsl_mc_uapi_send_command(unsigned long arg,
> > +				    struct fsl_mc_io *mc_io)
> > +{
> > +	struct fsl_mc_command mc_cmd;
> > +	int error;
> > +
> > +	error =3D copy_from_user(&mc_cmd, (void __user *)arg, sizeof(mc_cmd))=
;
> > +	if (error)
> > +		return -EFAULT;
> > +
> > +	error =3D mc_send_command(mc_io, &mc_cmd);
> > +	if (error)
> > +		return error;
> > +
> > +	error =3D copy_to_user((void __user *)arg, &mc_cmd, sizeof(mc_cmd));
> > +	if (error)
> > +		return -EFAULT;
> > +
> > +	return 0;
> > +}
>=20
> I know you said that "the firmware will properly verify the command"
> already, but given that I used to be a firmware developer a long time ago=
, I can
> almost guarantee that this will cause problems in the future.
>=20
> Want to make a friendly bet about this?
>=20
> What is the odds that your firmware api/interface has been properly fuzze=
d such
> that all possible combinations of bad commands will really not do horribl=
e things
> to the hardware/system?
>=20
> Are you all willing to bet the system intregrity on this?  If so, ok, it'=
s your systems
> :)
>=20
> Personally, I think you need to add a "known whitelist" and do some sort =
of
> sanity checking here.
>=20

I can add a whitelist on the command ids that can be received from userspac=
e but
leave the parameter parsing to the firmware to process and interpret depend=
ing on the
current system settings.

Would that be a viable option from your point of view?

Ioana C

> thanks,
>=20
> greg k-h