Messages in this thread Patch in this message | | | Date | Tue, 06 Nov 2012 08:03:16 +0100 | From | Takashi Iwai <> | Subject | Re: [PATCH RFC 0/4] Add firmware signature file check |
| |
At Tue, 6 Nov 2012 10:30:26 +0800, Ming Lei wrote: > > On Tue, Nov 6, 2012 at 1:18 AM, Takashi Iwai <tiwai@suse.de> wrote: > > > > To be noted, it doesn't support the firmwares via udev but only the > > direct loading, and the check for built-in firmware is missing, too. > > Generally, both direct loading and udev may request one same firmware > image. And after check failed, current firmware load will fallback on udev > to complete loading, so looks a check-failed firmware still can be loaded > into kernel no matter if there is firmware signature check or not.
Yeah, it's just uncovered in the patch. As a easy solution, apply the patch like below to disallow the udev fw loading when signature check is enforced.
thanks,
Takashi
--- diff --git a/drivers/base/firmware_class.c b/drivers/base/firmware_class.c index 575bc4c..93121c3 100644 --- a/drivers/base/firmware_class.c +++ b/drivers/base/firmware_class.c @@ -912,6 +912,13 @@ static int _request_firmware_load(struct firmware_priv *fw_priv, bool uevent, goto handle_fw; } + /* signature check isn't handled via udev fw loading */ + if (sig_enforce) { + fw_load_abort(fw_priv); + direct_load = 1; + goto handle_fw; + } + /* fall back on userspace loading */ buf->fmt = PAGE_BUF;
| |