Unverified Commit 208f0b9d authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!12519 fix CVE-2024-47742 

Merge Pull Request from: @ci-robot 
 
PR sync from: Lin Yujun <linyujun809@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/37IFFYCEYWU5ZLKDIRK57GSEONOXYHTW/ 
Jann Horn (1):
  firmware_loader: Block path traversal


-- 
2.34.1
 
https://gitee.com/src-openeuler/kernel/issues/IAYQRX 
 
Link:https://gitee.com/openeuler/kernel/pulls/12519

 

Reviewed-by: default avatarZhang Jianhua <chris.zjh@huawei.com>
Signed-off-by: default avatarZhang Changzhong <zhangchangzhong@huawei.com>
parents d3ae2925 6b9dfda6

drivers/base/firmware_loader/main.c

+30 −0
Original line number Diff line number Diff line
@@ -562,6 +562,26 @@ static void fw_abort_batch_reqs(struct firmware *fw) 
		fw_state_aborted(fw_priv);

}



/*

 * Reject firmware file names with ".." path components.

 * There are drivers that construct firmware file names from device-supplied

 * strings, and we don't want some device to be able to tell us "I would like to

 * be sent my firmware from ../../../etc/shadow, please".

 *

 * Search for ".." surrounded by either '/' or start/end of string.

 *

 * This intentionally only looks at the firmware name, not at the firmware base

 * directory or at symlink contents.

 */

static bool name_contains_dotdot(const char *name)

{

    size_t name_len = strlen(name);



    return strcmp(name, "..") == 0 || strncmp(name, "../", 3) == 0 || 

           strstr(name, "/../") != NULL ||

           (name_len >= 3 && strcmp(name+name_len-3, "/..") == 0);

}



/* called from request_firmware() and request_firmware_work_func() */

static int

_request_firmware(const struct firmware **firmware_p, const char *name,
@@ -579,6 +599,14 @@ _request_firmware(const struct firmware **firmware_p, const char *name, 
		goto out;

	}



    if (name_contains_dotdot(name)) {

        dev_warn(device,

             "Firmware load for '%s' refused, path contains '..' component\n",

             name);

        ret = -EINVAL;

        goto out;

    }



	ret = _request_firmware_prepare(&fw, name, device, buf, size,

					opt_flags);

	if (ret <= 0) /* error or already assigned */
@@ -619,6 +647,8 @@ _request_firmware(const struct firmware **firmware_p, const char *name, 
 *      @name will be used as $FIRMWARE in the uevent environment and

 *      should be distinctive enough not to be confused with any other

 *      firmware image for this or any other device.

 *	It must not contain any ".." path components - "foo/bar..bin" is

 *	allowed, but "foo/../bar.bin" is not.

 *

 *	Caller must hold the reference count of @device.

 *