Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1313634 > unrolled thread
| Started by | Dan Williams <dan.j.williams@intel.com> |
|---|---|
| First post | 2016-01-20 23:40 +0100 |
| Last post | 2016-01-21 01:00 +0100 |
| Articles | 5 — 2 participants |
Back to article view | Back to linux.kernel
[PATCH] fix CONFIG_IO_STRICT_DEVMEM, do not enable by default Dan Williams <dan.j.williams@intel.com> - 2016-01-20 23:40 +0100
Re: [PATCH] fix CONFIG_IO_STRICT_DEVMEM, do not enable by default Kees Cook <keescook@chromium.org> - 2016-01-21 00:20 +0100
Re: [PATCH] fix CONFIG_IO_STRICT_DEVMEM, do not enable by default Dan Williams <dan.j.williams@intel.com> - 2016-01-21 00:50 +0100
Re: [PATCH] fix CONFIG_IO_STRICT_DEVMEM, do not enable by default Dan Williams <dan.j.williams@intel.com> - 2016-01-21 01:00 +0100
Re: [PATCH] fix CONFIG_IO_STRICT_DEVMEM, do not enable by default Kees Cook <keescook@chromium.org> - 2016-01-21 01:00 +0100
| From | Dan Williams <dan.j.williams@intel.com> |
|---|---|
| Date | 2016-01-20 23:40 +0100 |
| Subject | [PATCH] fix CONFIG_IO_STRICT_DEVMEM, do not enable by default |
| Message-ID | <qT9zY-4u9-5@gated-at.bofh.it> |
Larry reports: "My PowerBook G4 Aluminum with a 32-bit PPC processor
fails to boot for the 4.4-git series". This is likely due to X still
needing /dev/mem access on this platform.
CONFIG_IO_STRICT_DEVMEM is not yet safe to turn on when
CONFIG_STRICT_DEVMEM=y. Remove the default so that old configurations
do not change behavior.
Fixes: 90a545e98126 ("restrict /dev/mem to idle io memory ranges")
Reported-by: Larry Finger <Larry.Finger@lwfinger.net>
Tested-by: Larry Finger <Larry.Finger@lwfinger.net>
Link: http://marc.info/?l=linux-kernel&m=145332012023825&w=2
Cc: Arnd Bergmann <arnd@arndb.de>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: Kees Cook <keescook@chromium.org>
Cc: Russell King <linux@arm.linux.org.uk>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Dan Williams <dan.j.williams@intel.com>
---
lib/Kconfig.debug | 1 -
1 file changed, 1 deletion(-)
diff --git a/lib/Kconfig.debug b/lib/Kconfig.debug
index f75a33f29f6e..7d0b49c536c5 100644
--- a/lib/Kconfig.debug
+++ b/lib/Kconfig.debug
@@ -1919,7 +1919,6 @@ config STRICT_DEVMEM
config IO_STRICT_DEVMEM
bool "Filter I/O access to /dev/mem"
depends on STRICT_DEVMEM
- default STRICT_DEVMEM
---help---
If this option is disabled, you allow userspace (root) access to all
io-memory regardless of whether a driver is actively using that
[toc] | [next] | [standalone]
| From | Kees Cook <keescook@chromium.org> |
|---|---|
| Date | 2016-01-21 00:20 +0100 |
| Message-ID | <qTacF-4ZC-13@gated-at.bofh.it> |
| In reply to | #1313634 |
On Wed, Jan 20, 2016 at 2:37 PM, Dan Williams <dan.j.williams@intel.com> wrote:
> Larry reports: "My PowerBook G4 Aluminum with a 32-bit PPC processor
> fails to boot for the 4.4-git series". This is likely due to X still
> needing /dev/mem access on this platform.
>
> CONFIG_IO_STRICT_DEVMEM is not yet safe to turn on when
> CONFIG_STRICT_DEVMEM=y. Remove the default so that old configurations
> do not change behavior.
>
> Fixes: 90a545e98126 ("restrict /dev/mem to idle io memory ranges")
> Reported-by: Larry Finger <Larry.Finger@lwfinger.net>
> Tested-by: Larry Finger <Larry.Finger@lwfinger.net>
> Link: http://marc.info/?l=linux-kernel&m=145332012023825&w=2
> Cc: Arnd Bergmann <arnd@arndb.de>
> Cc: Ingo Molnar <mingo@redhat.com>
> Cc: Kees Cook <keescook@chromium.org>
> Cc: Russell King <linux@arm.linux.org.uk>
> Cc: Andrew Morton <akpm@linux-foundation.org>
> Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> Signed-off-by: Dan Williams <dan.j.williams@intel.com>
Acked-by: Kees Cook <keescook@chromium.org>
This should probably be CC: stable, yes?
-Kees
> ---
> lib/Kconfig.debug | 1 -
> 1 file changed, 1 deletion(-)
>
> diff --git a/lib/Kconfig.debug b/lib/Kconfig.debug
> index f75a33f29f6e..7d0b49c536c5 100644
> --- a/lib/Kconfig.debug
> +++ b/lib/Kconfig.debug
> @@ -1919,7 +1919,6 @@ config STRICT_DEVMEM
> config IO_STRICT_DEVMEM
> bool "Filter I/O access to /dev/mem"
> depends on STRICT_DEVMEM
> - default STRICT_DEVMEM
> ---help---
> If this option is disabled, you allow userspace (root) access to all
> io-memory regardless of whether a driver is actively using that
>
--
Kees Cook
Chrome OS & Brillo Security
[toc] | [prev] | [next] | [standalone]
| From | Dan Williams <dan.j.williams@intel.com> |
|---|---|
| Date | 2016-01-21 00:50 +0100 |
| Message-ID | <qTaFI-5bZ-17@gated-at.bofh.it> |
| In reply to | #1313652 |
On Wed, Jan 20, 2016 at 3:12 PM, Kees Cook <keescook@chromium.org> wrote:
> On Wed, Jan 20, 2016 at 2:37 PM, Dan Williams <dan.j.williams@intel.com> wrote:
>> Larry reports: "My PowerBook G4 Aluminum with a 32-bit PPC processor
>> fails to boot for the 4.4-git series". This is likely due to X still
>> needing /dev/mem access on this platform.
>>
>> CONFIG_IO_STRICT_DEVMEM is not yet safe to turn on when
>> CONFIG_STRICT_DEVMEM=y. Remove the default so that old configurations
>> do not change behavior.
>>
>> Fixes: 90a545e98126 ("restrict /dev/mem to idle io memory ranges")
>> Reported-by: Larry Finger <Larry.Finger@lwfinger.net>
>> Tested-by: Larry Finger <Larry.Finger@lwfinger.net>
>> Link: http://marc.info/?l=linux-kernel&m=145332012023825&w=2
>> Cc: Arnd Bergmann <arnd@arndb.de>
>> Cc: Ingo Molnar <mingo@redhat.com>
>> Cc: Kees Cook <keescook@chromium.org>
>> Cc: Russell King <linux@arm.linux.org.uk>
>> Cc: Andrew Morton <akpm@linux-foundation.org>
>> Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
>> Signed-off-by: Dan Williams <dan.j.williams@intel.com>
>
> Acked-by: Kees Cook <keescook@chromium.org>
>
Thanks!
> This should probably be CC: stable, yes?
No, this breakage is new for the current merge window.
[toc] | [prev] | [next] | [standalone]
| From | Dan Williams <dan.j.williams@intel.com> |
|---|---|
| Date | 2016-01-21 01:00 +0100 |
| Message-ID | <qTaPn-5fi-1@gated-at.bofh.it> |
| In reply to | #1313709 |
On Wed, Jan 20, 2016 at 3:53 PM, Kees Cook <keescook@chromium.org> wrote:
> On Wed, Jan 20, 2016 at 3:48 PM, Dan Williams <dan.j.williams@intel.com> wrote:
>> On Wed, Jan 20, 2016 at 3:12 PM, Kees Cook <keescook@chromium.org> wrote:
>>> On Wed, Jan 20, 2016 at 2:37 PM, Dan Williams <dan.j.williams@intel.com> wrote:
>>>> Larry reports: "My PowerBook G4 Aluminum with a 32-bit PPC processor
>>>> fails to boot for the 4.4-git series". This is likely due to X still
>>>> needing /dev/mem access on this platform.
>>>>
>>>> CONFIG_IO_STRICT_DEVMEM is not yet safe to turn on when
>>>> CONFIG_STRICT_DEVMEM=y. Remove the default so that old configurations
>>>> do not change behavior.
>>>>
>>>> Fixes: 90a545e98126 ("restrict /dev/mem to idle io memory ranges")
>>>> Reported-by: Larry Finger <Larry.Finger@lwfinger.net>
>>>> Tested-by: Larry Finger <Larry.Finger@lwfinger.net>
>>>> Link: http://marc.info/?l=linux-kernel&m=145332012023825&w=2
>>>> Cc: Arnd Bergmann <arnd@arndb.de>
>>>> Cc: Ingo Molnar <mingo@redhat.com>
>>>> Cc: Kees Cook <keescook@chromium.org>
>>>> Cc: Russell King <linux@arm.linux.org.uk>
>>>> Cc: Andrew Morton <akpm@linux-foundation.org>
>>>> Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
>>>> Signed-off-by: Dan Williams <dan.j.williams@intel.com>
>>>
>>> Acked-by: Kees Cook <keescook@chromium.org>
>>>
>>
>> Thanks!
>>
>>> This should probably be CC: stable, yes?
>>
>> No, this breakage is new for the current merge window.
>
> Ah! Okay, I misunderstood the "4.4" comment. Should that be 4.5-git?
I believe Larry meant latest-Linus (v4.4.0+) when he said 4.4-git.
[toc] | [prev] | [next] | [standalone]
| From | Kees Cook <keescook@chromium.org> |
|---|---|
| Date | 2016-01-21 01:00 +0100 |
| Message-ID | <qTaPn-5fi-3@gated-at.bofh.it> |
| In reply to | #1313709 |
On Wed, Jan 20, 2016 at 3:48 PM, Dan Williams <dan.j.williams@intel.com> wrote:
> On Wed, Jan 20, 2016 at 3:12 PM, Kees Cook <keescook@chromium.org> wrote:
>> On Wed, Jan 20, 2016 at 2:37 PM, Dan Williams <dan.j.williams@intel.com> wrote:
>>> Larry reports: "My PowerBook G4 Aluminum with a 32-bit PPC processor
>>> fails to boot for the 4.4-git series". This is likely due to X still
>>> needing /dev/mem access on this platform.
>>>
>>> CONFIG_IO_STRICT_DEVMEM is not yet safe to turn on when
>>> CONFIG_STRICT_DEVMEM=y. Remove the default so that old configurations
>>> do not change behavior.
>>>
>>> Fixes: 90a545e98126 ("restrict /dev/mem to idle io memory ranges")
>>> Reported-by: Larry Finger <Larry.Finger@lwfinger.net>
>>> Tested-by: Larry Finger <Larry.Finger@lwfinger.net>
>>> Link: http://marc.info/?l=linux-kernel&m=145332012023825&w=2
>>> Cc: Arnd Bergmann <arnd@arndb.de>
>>> Cc: Ingo Molnar <mingo@redhat.com>
>>> Cc: Kees Cook <keescook@chromium.org>
>>> Cc: Russell King <linux@arm.linux.org.uk>
>>> Cc: Andrew Morton <akpm@linux-foundation.org>
>>> Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
>>> Signed-off-by: Dan Williams <dan.j.williams@intel.com>
>>
>> Acked-by: Kees Cook <keescook@chromium.org>
>>
>
> Thanks!
>
>> This should probably be CC: stable, yes?
>
> No, this breakage is new for the current merge window.
Ah! Okay, I misunderstood the "4.4" comment. Should that be 4.5-git?
--
Kees Cook
Chrome OS & Brillo Security
[toc] | [prev] | [standalone]
Back to top | Article view | linux.kernel
csiph-web