Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1653341

Re: [PATCH 1/4] firmware: add firmware signing

Show all headers | View raw

On Fri, 2017-05-26 at 12:06 +0900, AKASHI Takahiro wrote:
> There is one driver data option, DRIVER_DATA_REQ_NO_SIG_CHECK,
> which will skip signature verification check at load time
> even in enforcing mode.
> This option is solely for non security-sensitive data.

It's also for firmware that is already signed and checked by the
hardware. In the x86 world almost all modern era firmware is already
signed and the signature checked by the device.

> +static ssize_t firmware_sig_data_write(struct file *filp, struct
> kobject *kobj,
> +				       struct bin_attribute
> *bin_attr,
> +				       char *buffer, loff_t offset,
> +				       size_t count)
> +{
> +	struct device *dev = kobj_to_dev(kobj);
> +	struct firmware_priv *fw_priv = to_firmware_priv(dev);
> +	struct firmware_buf *buf;
> +	void *buf_tmp;
> +	size_t new_size;
> +	ssize_t ret_count;
> +
> +	if (!capable(CAP_SYS_RAWIO))
> +		return -EPERM;
> +
> +	mutex_lock(&fw_lock);
> +	buf = fw_priv->buf;
> +	if (!buf || fw_state_is_done(&buf->fw_st)) {
> +		ret_count = -ENODEV;
> +		goto out;
> +	}
> +
> +	if (buf->sig_data && (offset + count > buf->sig_size)) {

If I do a ridiculously long amount of I/O what stops offset + count
overflowing ? It's no big deal as its CAP_SYS_RAWIO anyway but I'm just
wondering if there is a test missing ?

Alan

Back to linux.kernel | Previous | Next — Previous in thread | Find similar | Unroll thread

Thread

[PATCH 1/4] firmware: add firmware signing AKASHI Takahiro <takahiro.akashi@linaro.org> - 2017-05-26 05:10 +0200
  Re: [PATCH 1/4] firmware: add firmware signing Alan Cox <alan@linux.intel.com> - 2017-05-30 18:10 +0200

csiph-web