From mboxrd@z Thu Jan 1 00:00:00 1970 Return-path: Received: from mail-pf0-x241.google.com ([2607:f8b0:400e:c00::241]) by bombadil.infradead.org with esmtps (Exim 4.90_1 #2 (Red Hat Linux)) id 1fdiJ3-00069d-Ht for kexec@lists.infradead.org; Thu, 12 Jul 2018 20:35:20 +0000 Received: by mail-pf0-x241.google.com with SMTP id e10-v6so21270105pfn.1 for ; Thu, 12 Jul 2018 13:35:06 -0700 (PDT) Date: Thu, 12 Jul 2018 13:37:46 -0700 From: Bjorn Andersson Subject: Re: [PATCH v5 7/8] ima: based on policy warn about loading firmware (pre-allocated buffer) Message-ID: <20180712203746.GG545@tuxbook-pro> References: <1530542283-26145-1-git-send-email-zohar@linux.vnet.ibm.com> <1530542283-26145-8-git-send-email-zohar@linux.vnet.ibm.com> <1531165294.3332.40.camel@linux.ibm.com> <20180710191951.GF1731@minitux> <1531425793.3568.275.camel@linux.ibm.com> MIME-Version: 1.0 Content-Disposition: inline In-Reply-To: <1531425793.3568.275.camel@linux.ibm.com> List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Sender: "kexec" Errors-To: kexec-bounces+dwmw2=infradead.org@lists.infradead.org To: Mimi Zohar Cc: Andres Rodriguez , Kees Cook , Ard Biesheuvel , Stephen Boyd , Greg Kroah-Hartman , "Luis R . Rodriguez" , Kexec Mailing List , Linux Kernel Mailing List , David Howells , linux-security-module , "Luis R . Rodriguez" , linux-integrity , "Serge E . Hallyn" , Mimi Zohar , Eric Biederman On Thu 12 Jul 13:03 PDT 2018, Mimi Zohar wrote: > On Wed, 2018-07-11 at 08:24 +0200, Ard Biesheuvel wrote: > > On 10 July 2018 at 21:19, Bjorn Andersson = wrote: > = > > > Tbh the only case I can think of where there would be a "race conditi= on" > > > here is if we have a device that is polling the last byte of a > > > predefined firmware memory area for the firmware loader to read some > > > specific data into it. In cases where the firmware request is followed > > > by some explicit signalling to the device (or a power on sequence) I'm > > > unable to see the issue discussed here. > > > > > = > > I agree. But the latter part is platform specific, and so it requires > > some degree of trust in the driver author on the part of the IMA > > routines that request_firmware() is called at an appropriate time. > = > Exactly. =A0Qualcomm could be using the pre-allocated buffer > appropriately, but that doesn't guarantee how it will be used in the > future. > = Agreed. But a device that starts operate on the firmware memory before it's fully loaded (and verified) will likely hit other nasty issues. Using a traditional request_firmware() and memcpy() or simply mapping the buffer into the remote piecemeal would have the same issue. So I think that regardless of using IMA, if you don't have the ability to control your device's view of the entire firmware buffer atomically you must write your device drivers accordingly. Regards, Bjorn _______________________________________________ kexec mailing list kexec@lists.infradead.org http://lists.infradead.org/mailman/listinfo/kexec