aboutsummaryrefslogtreecommitdiffstats
path: root/drivers/firewire
diff options
context:
space:
mode:
authorStefan Richter <stefanr@s5r6.in-berlin.de>2009-01-04 10:23:29 -0500
committerStefan Richter <stefanr@s5r6.in-berlin.de>2009-03-24 15:56:45 -0400
commit1566f3dc3e5986a16c7bbb3bb95bb691251a8d25 (patch)
tree3a6a5f6c29cbd9d71354fede1e6da69273ec803d /drivers/firewire
parentacfe8333572cad5dc70fce18ac966be0446548d7 (diff)
firewire: cdev: restrict broadcast write requests to Units Space
We don't want random users write to Memory Space (e.g. PCs with physical DMA filters down) or to core CSRs like Reset_Start. This does not protect SBP-2 target CSRs. But properly behaving SBP-2 targets ignore broadcast write requests to these registers, and the maximum damage which can happen with laxer targets is DOS. But there are ways to create DOS situations anyway if there are devices with weak device file permissions (like audio/video devices) present at the same bus as an SBP-2 target. Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>
Diffstat (limited to 'drivers/firewire')
-rw-r--r--drivers/firewire/fw-cdev.c4
1 files changed, 4 insertions, 0 deletions
diff --git a/drivers/firewire/fw-cdev.c b/drivers/firewire/fw-cdev.c
index a1637a86da3d..d48fa1c23a77 100644
--- a/drivers/firewire/fw-cdev.c
+++ b/drivers/firewire/fw-cdev.c
@@ -1245,6 +1245,10 @@ static int ioctl_send_broadcast_request(struct client *client, void *buffer)
1245 return -EINVAL; 1245 return -EINVAL;
1246 } 1246 }
1247 1247
1248 /* Security policy: Only allow accesses to Units Space. */
1249 if (request->offset < CSR_REGISTER_BASE + CSR_CONFIG_ROM_END)
1250 return -EACCES;
1251
1248 return init_request(client, request, LOCAL_BUS | 0x3f, SCODE_100); 1252 return init_request(client, request, LOCAL_BUS | 0x3f, SCODE_100);
1249} 1253}
1250 1254