Received: by 2002:a6b:500f:0:0:0:0:0 with SMTP id e15csp242813iob; Mon, 2 May 2022 18:17:11 -0700 (PDT) X-Google-Smtp-Source: ABdhPJypWqFBghtfoqDXzu+WYZO25ft7ygVNkiEYPEpT30DKLGITzaPwxmYJVv8jDasu2D8PAwS9 X-Received: by 2002:a05:6a00:1907:b0:4f7:945:14cf with SMTP id y7-20020a056a00190700b004f7094514cfmr13746678pfi.47.1651540631717; Mon, 02 May 2022 18:17:11 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1651540631; cv=none; d=google.com; s=arc-20160816; b=lc6YCvU6jSZSglEzwRztnA3YT/BG+HO2tgnJ8aaW5lPrg0HiD7cs6qePF/xq6XpbQG SvLTAsdi4sRHiqT+gBU4hPhAyQvjz52BFYFcQRgY5LRQY9cVcTBocfF8WpAbURF9SF6s JY6g3KUZub889P4Hvz9q44mgpsjbYz+Cvqp4OUkcHCjPMRIe6OQQjtew/iVHI/2xjqBW LE13MzHF5UWOGGAu7cVdXR9Nl62JmpdG7Vjxj+W1Y9D5a2jXmZEhXFQxwIXqTovcfecO 4gCm6I63jt2iC3V4lYpEhYvmm2Dg3niR/Ai8x8DVRonlBKfWTTkeQKwSLnH+XEAjIs9q VK4A== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:cc:to:from:subject :mime-version:message-id:date:dkim-signature; bh=FOMU61QtLNIhCcO443IaAbPythoovtkrDMR8bH0Vhu8=; b=BhPOc2NYUKVCRQq7erBe0SMc8u3ko9dQWfHFHRLlBIRkDEfT2DeL/F2CrBS1fMEHD8 txHC0CK+xnhCcjRXA5u9CiXRXQsxVb67l+dc5W4k1Fg6QRrOSK3rmdCUJ/WUhaQsV7oj uu6TqcqHIkru9jgXt1b6ip2sfV/ejsElSR4bE5Eps2qb58qxgWIiE5D7qzcPPiKRZXJM xKc1tJ5Q2auoGBXrZ9yZBM3XB2SvWTEDfN108brwkuzC9a3kg72nxbf6k17BfLCNcmT8 tEZuncuOI/6terxyS++t4LQ4f5u6GjbEuGg56aDakk5qgXwj/aV0uXh9eZ/bquetQMNF saVg== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@google.com header.s=20210112 header.b="H/HLblGg"; spf=softfail (google.com: domain of transitioning linux-kernel-owner@vger.kernel.org does not designate 23.128.96.19 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=google.com Return-Path: Received: from lindbergh.monkeyblade.net (lindbergh.monkeyblade.net. [23.128.96.19]) by mx.google.com with ESMTPS id bg7-20020a056a02010700b0039cef730af0si15548330pgb.608.2022.05.02.18.17.11 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 02 May 2022 18:17:11 -0700 (PDT) Received-SPF: softfail (google.com: domain of transitioning linux-kernel-owner@vger.kernel.org does not designate 23.128.96.19 as permitted sender) client-ip=23.128.96.19; Authentication-Results: mx.google.com; dkim=pass header.i=@google.com header.s=20210112 header.b="H/HLblGg"; spf=softfail (google.com: domain of transitioning linux-kernel-owner@vger.kernel.org does not designate 23.128.96.19 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=google.com Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by lindbergh.monkeyblade.net (Postfix) with ESMTP id DDBDB49CBC; Mon, 2 May 2022 17:56:49 -0700 (PDT) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1356416AbiEBAyF (ORCPT + 99 others); Sun, 1 May 2022 20:54:05 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:48724 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1379420AbiEBAxu (ORCPT ); Sun, 1 May 2022 20:53:50 -0400 Received: from mail-pg1-x549.google.com (mail-pg1-x549.google.com [IPv6:2607:f8b0:4864:20::549]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id D83811115A for ; Sun, 1 May 2022 17:50:22 -0700 (PDT) Received: by mail-pg1-x549.google.com with SMTP id bj12-20020a056a02018c00b003a9eebaad34so6223510pgb.10 for ; Sun, 01 May 2022 17:50:22 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20210112; h=date:message-id:mime-version:subject:from:to:cc :content-transfer-encoding; bh=FOMU61QtLNIhCcO443IaAbPythoovtkrDMR8bH0Vhu8=; b=H/HLblGgD5zGZse8AT1acfVSeM49QjDg79wsGCl7L9/XBqXSNg3gxiHjZgEG6HpQ8q aLNKL7jPld9jWS5findWpdmJJfvyxQ8xz6bEgteN1jSTAbP2tOpaFN+Hc+1xSAPtUztJ wrA75uF5O0XKkM1LYMsmUUkvXmbZRRU5b/1UWvKM1ZuiE8DAc2PuhbTXRbgoTmzKq8lY H39d6lX/9SnLCKOlxd+IrkhPKOkaD1UZWZuov5ADI/UqKCsHZvyTBMuxWWjDrfWJ9x0k 4oJOWcjxbsxuTi5hBNDLfd2BDE1U7eVN03avaJjXaJAEtdpIonXWl4+A2QlaUt/64b/+ ZR7w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:date:message-id:mime-version:subject:from:to:cc :content-transfer-encoding; bh=FOMU61QtLNIhCcO443IaAbPythoovtkrDMR8bH0Vhu8=; b=GjNOlhxSp+XhUR0y0t8pxZjhZNdd+/rL2Q9+u7P5qdbOMKKCmu/kqSCPyCoVfu8Flp wz76wN3ZGfO1dD8m5NxxLnWTTNqD9NHQAddcexjxAB2XHTZDTrxPFIdwcCTcfi+EpacD VSWtxxSccAX7xuQJm6Xoc39DTtNETb8wynJWPvqbfVRF3N9piLVn9iqPwN8QitQn7tiP Z+vBi1O43bXcSx6VzDGbrOy1YvoxJV1rIFZiwn5vCON0XscbijhQ/ziUCMm6BlIObsTJ KJROxlMN9Ae025bJok3K1mELYblpmNn9J2xdF5eL1MlS6IQa3xTAqhPyinMtgBTXR1/6 2JNw== X-Gm-Message-State: AOAM530sn3xIPTB1IV94/wosICEdJuOiVBM8vdjOrt5h145bSodkFT77 qJaYacSSAUSB1rZHWSqzlsSlOcLG/g== X-Received: from tweek-sin.c.googlers.com ([fda3:e722:ac3:cc00:4f:4b78:c0a8:2bfd]) (user=tweek job=sendgmr) by 2002:a17:902:f28b:b0:15c:5c21:dc15 with SMTP id k11-20020a170902f28b00b0015c5c21dc15mr9690735plc.16.1651452621491; Sun, 01 May 2022 17:50:21 -0700 (PDT) Date: Mon, 2 May 2022 10:49:52 +1000 Message-Id: <20220502004952.3970800-1-tweek@google.com> Mime-Version: 1.0 X-Mailer: git-send-email 2.36.0.464.gb9c8b46e94-goog Subject: [PATCH v4] firmware_loader: use kernel credentials when reading firmware From: "=?UTF-8?q?Thi=C3=A9baud=20Weksteen?=" To: Luis Chamberlain , Greg Kroah-Hartman , Qian Cai , John Stultz Cc: Jeffrey Vander Stoep , Saravana Kannan , Alistair Delva , Adam Shih , selinux@vger.kernel.org, linux-kernel@vger.kernel.org, "=?UTF-8?q?Thi=C3=A9baud=20Weksteen?=" , stable@vger.kernel.org Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable X-Spam-Status: No, score=-9.5 required=5.0 tests=BAYES_00,DKIMWL_WL_MED, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI,RDNS_NONE,SPF_HELO_NONE,T_SCC_BODY_TEXT_LINE, USER_IN_DEF_DKIM_WL autolearn=no autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Device drivers may decide to not load firmware when probed to avoid slowing down the boot process should the firmware filesystem not be available yet. In this case, the firmware loading request may be done when a device file associated with the driver is first accessed. The credentials of the userspace process accessing the device file may be used to validate access to the firmware files requested by the driver. Ensure that the kernel assumes the responsibility of reading the firmware. This was observed on Android for a graphic driver loading their firmware when the device file (e.g. /dev/mali0) was first opened by userspace (i.e. surfaceflinger). The security context of surfaceflinger was used to validate the access to the firmware file (e.g. /vendor/firmware/mali.bin). Previously, Android configurations were not setting up the firmware_class.path command line argument and were relying on the userspace fallback mechanism. In this case, the security context of the userspace daemon (i.e. ueventd) was consistently used to read firmware files. More Android devices are now found to set firmware_class.path which gives the kernel the opportunity to read the firmware directly (via kernel_read_file_from_path_initns). In this scenario, the current process credentials were used, even if unrelated to the loading of the firmware file. Signed-off-by: Thi=C3=A9baud Weksteen Cc: # 5.10 --- v4: Add stable to Cc v3: - Add call to put_cred to avoid a memory leak. Confirmed that no new memory leak occurs on a Pixel 4a. - Update commit log. v2: Add comment drivers/base/firmware_loader/main.c | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/drivers/base/firmware_loader/main.c b/drivers/base/firmware_lo= ader/main.c index 94d1789a233e..406a907a4cae 100644 --- a/drivers/base/firmware_loader/main.c +++ b/drivers/base/firmware_loader/main.c @@ -735,6 +735,8 @@ _request_firmware(const struct firmware **firmware_p, c= onst char *name, size_t offset, u32 opt_flags) { struct firmware *fw =3D NULL; + struct cred *kern_cred =3D NULL; + const struct cred *old_cred; bool nondirect =3D false; int ret; =20 @@ -751,6 +753,18 @@ _request_firmware(const struct firmware **firmware_p, = const char *name, if (ret <=3D 0) /* error or already assigned */ goto out; =20 + /* + * We are about to try to access the firmware file. Because we may have b= een + * called by a driver when serving an unrelated request from userland, we= use + * the kernel credentials to read the file. + */ + kern_cred =3D prepare_kernel_cred(NULL); + if (!kern_cred) { + ret =3D -ENOMEM; + goto out; + } + old_cred =3D override_creds(kern_cred); + ret =3D fw_get_filesystem_firmware(device, fw->priv, "", NULL); =20 /* Only full reads can support decompression, platform, and sysfs. */ @@ -776,6 +790,9 @@ _request_firmware(const struct firmware **firmware_p, c= onst char *name, } else ret =3D assign_fw(fw, device); =20 + revert_creds(old_cred); + put_cred(kern_cred); + out: if (ret < 0) { fw_abort_batch_reqs(fw); --=20 2.36.0.464.gb9c8b46e94-goog