linux-toradex.git/drivers/firmware/google, branch v4.13-rc7

Merge 4.12-rc5 into char-misc-next

2017-06-12T06:18:10+00:00

We want the char/misc driver fixes in here as well.

Signed-off-by: Greg Kroah-Hartman

Revert "firmware: vpd: remove platform driver"

2017-05-27T09:46:26+00:00

This reverts commit 7975bd4cca05a99aa14964cfa22366ee64da50ad, because
VPD relies on driver core to handle deferrals returned by
coreboot_table_find().

Signed-off-by: Dmitry Torokhov 
Reviewed-by: Guenter Roeck 
Signed-off-by: Greg Kroah-Hartman

firmware: vpd: remove platform driver

2017-05-25T13:41:20+00:00

There is no reason why VPD should register platform device and driver,
given that we do not use their respective kobjects to attach attributes,
nor do we need suspend/resume hooks, or any other features of device
core.

Signed-off-by: Dmitry Torokhov 
Reviewed-by: Guenter Roeck 
Signed-off-by: Greg Kroah-Hartman

firmware: vpd: do not clear statically allocated data

2017-05-25T13:41:20+00:00

ro_vpd and rw_vpd are static module-scope variables that are guaranteed
to be initialized with zeroes, there is no need for explicit memset().

Signed-off-by: Dmitry Torokhov 
Reviewed-by: Guenter Roeck 
Signed-off-by: Greg Kroah-Hartman

firmware: vpd: use kasprintf() when forming name of 'raw' attribute

2017-05-25T13:41:20+00:00

When creating name for the "raw" attribute, let's switch to using
kaspeintf() instead of doing it by hand. Also make sure we handle
errors.

Signed-off-by: Dmitry Torokhov 
Reviewed-by: Guenter Roeck 
Signed-off-by: Greg Kroah-Hartman

firmware: vpd: use kdtrndup when copying section key

2017-05-25T13:41:20+00:00

Instead of open-coding kstrndup with kzalloc + memcpy, let's use
the helper.

Signed-off-by: Dmitry Torokhov 
Reviewed-by: Guenter Roeck 
Signed-off-by: Greg Kroah-Hartman

firmware: vpd: do not leak kobjects

2017-05-25T13:37:16+00:00

kobject_del() only unlinks kobject, we need to use kobject_put() to
make sure kobject will go away completely.

Fixes: 049a59db34eb ("firmware: Google VPD sysfs driver")
Signed-off-by: Dmitry Torokhov 
Reviewed-by: Guenter Roeck 
Signed-off-by: Greg Kroah-Hartman

firmware: vpd: avoid potential use-after-free when destroying section

2017-05-25T13:37:16+00:00

We should not free info->key before we remove sysfs attribute that uses
this data as its name.

Fixes: 049a59db34eb ("firmware: Google VPD sysfs driver")
Signed-off-by: Dmitry Torokhov 
Reviewed-by: Guenter Roeck 
Signed-off-by: Greg Kroah-Hartman

firmware: vpd: do not leave freed section attributes to the list

2017-05-25T13:37:16+00:00

We should only add section attribute to the list of section attributes
if we successfully created corresponding sysfs attribute.

Fixes: 049a59db34eb ("firmware: Google VPD sysfs driver")
Signed-off-by: Dmitry Torokhov 
Reviewed-by: Guenter Roeck 
Signed-off-by: Greg Kroah-Hartman

firmware: google: memconsole: Prevent overrun attack on coreboot console

2017-05-25T13:35:19+00:00

The recent coreboot memory console update (firmware: google: memconsole:
Adapt to new coreboot ring buffer format) introduced a small security
issue in the driver: The new driver implementation parses the memory
console structure again on every access. This is intentional so that
additional lines added concurrently by runtime firmware can be read out.

However, if an attacker can write to the structure, they could increase
the size value to a point where the driver would read potentially
sensitive memory areas from outside the original console buffer during
the next access. This can be done through /dev/mem, since the console
buffer usually resides in firmware-reserved memory that is not covered
by STRICT_DEVMEM.

This patch resolves that problem by reading the buffer's size value only
once during boot (where we can still trust the structure). Other parts
of the structure can still be modified at runtime, but the driver's
bounds checks make sure that it will never read outside the buffer.

Fixes: a5061d028 ("firmware: google: memconsole: Adapt to new coreboot ring buffer format")
Signed-off-by: Julius Werner 
Signed-off-by: Greg Kroah-Hartman