mtd: Disable slram and phram when locked down

The slram and phram drivers both allow mapping regions of physical
address space such that they can then be read and written by userland
through the MTD interface.  This is probably usable to manipulate
hardware into overwriting kernel code on many systems.  Prevent that
if locked down.

Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Gbp-Pq: Topic features/all/lockdown
Gbp-Pq: Name mtd-disable-slram-and-phram-when-locked-down.patch

diff --git a/drivers/mtd/devices/phram.c b/drivers/mtd/devices/phram.c
index c467286ca007175d3f48e01b8b1e2f9f54f57f9c..edd50721325b81200364ebec46ea825fb418b4db 100644 (file)
--- a/drivers/mtd/devices/phram.c
+++ b/drivers/mtd/devices/phram.c
@@ -222,6 +222,9 @@ static int phram_setup(const char *val)
        uint64_t len;
        int i, ret;
 
+       if (kernel_is_locked_down("Command line-specified device addresses"))
+               return -EPERM;
+
        if (strnlen(val, sizeof(buf)) >= sizeof(buf))
                parse_err("parameter too long\n");
 

diff --git a/drivers/mtd/devices/slram.c b/drivers/mtd/devices/slram.c
index 28131a127d065e4e8aacf422d8a1724685a98949..de4fe135b0e39d5bfb0a0bbcd9fee559e85f5130 100644 (file)
--- a/drivers/mtd/devices/slram.c
+++ b/drivers/mtd/devices/slram.c
@@ -227,6 +227,9 @@ static int parse_cmdline(char *devname, char *szstart, char *szlength)
        unsigned long devstart;
        unsigned long devlength;
 
+       if (kernel_is_locked_down("Command line-specified device addresses"))
+               return -EPERM;
+
        if ((!devname) || (!szstart) || (!szlength)) {
                unregister_devices();
                return(-EINVAL);