diff options
| author | Stefan Richter <stefanr@s5r6.in-berlin.de> | 2009-01-04 16:23:29 +0100 |
|---|---|---|
| committer | Stefan Richter <stefanr@s5r6.in-berlin.de> | 2009-03-24 20:56:45 +0100 |
| commit | 1566f3dc3e5986a16c7bbb3bb95bb691251a8d25 (patch) | |
| tree | 3a6a5f6c29cbd9d71354fede1e6da69273ec803d /drivers/firewire | |
| parent | acfe8333572cad5dc70fce18ac966be0446548d7 (diff) | |
firewire: cdev: restrict broadcast write requests to Units Space
We don't want random users write to Memory Space (e.g. PCs with physical
DMA filters down) or to core CSRs like Reset_Start.
This does not protect SBP-2 target CSRs. But properly behaving SBP-2
targets ignore broadcast write requests to these registers, and the
maximum damage which can happen with laxer targets is DOS. But there
are ways to create DOS situations anyway if there are devices with weak
device file permissions (like audio/video devices) present at the same
bus as an SBP-2 target.
Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>
Diffstat (limited to 'drivers/firewire')
| -rw-r--r-- | drivers/firewire/fw-cdev.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/drivers/firewire/fw-cdev.c b/drivers/firewire/fw-cdev.c index a1637a86da3..d48fa1c23a7 100644 --- a/drivers/firewire/fw-cdev.c +++ b/drivers/firewire/fw-cdev.c @@ -1245,6 +1245,10 @@ static int ioctl_send_broadcast_request(struct client *client, void *buffer) return -EINVAL; } + /* Security policy: Only allow accesses to Units Space. */ + if (request->offset < CSR_REGISTER_BASE + CSR_CONFIG_ROM_END) + return -EACCES; + return init_request(client, request, LOCAL_BUS | 0x3f, SCODE_100); } |