mtd: Disable slram and phram when locked down

The slram and phram drivers both allow mapping regions of physical
address space such that they can then be read and written by userland
through the MTD interface.  This is probably usable to manipulate
hardware into overwriting kernel code on many systems.  Prevent that
if locked down.

Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Gbp-Pq: Topic features/all/lockdown
Gbp-Pq: Name mtd-disable-slram-and-phram-when-locked-down.patch

diff --git a/drivers/mtd/devices/phram.c b/drivers/mtd/devices/phram.c
index 9ee04b5f931139cbb6d119c6901c39a4a39cda0f..18af8e1353f072c8144b6e72682eecf58757d69a 100644 (file)
--- a/drivers/mtd/devices/phram.c
+++ b/drivers/mtd/devices/phram.c
@@ -219,6 +219,9 @@ static int phram_setup(const char *val)
        uint64_t len;
        int i, ret;
 
+       if (kernel_is_locked_down("Command line-specified device addresses"))
+               return -EPERM;
+
        if (strnlen(val, sizeof(buf)) >= sizeof(buf))
                parse_err("parameter too long\n");
 

diff --git a/drivers/mtd/devices/slram.c b/drivers/mtd/devices/slram.c
index 10183ee4e12b283dc87729d9d3e6dd9326ed220a..ea7725d2c00dc29b7df62414c69331ab7c167036 100644 (file)
--- a/drivers/mtd/devices/slram.c
+++ b/drivers/mtd/devices/slram.c
@@ -226,6 +226,9 @@ static int parse_cmdline(char *devname, char *szstart, char *szlength)
        unsigned long devstart;
        unsigned long devlength;
 
+       if (kernel_is_locked_down("Command line-specified device addresses"))
+               return -EPERM;
+
        if ((!devname) || (!szstart) || (!szlength)) {
                unregister_devices();
                return(-EINVAL);