thunderbolt: Correct access permissions for active NVM contents
Firmware upgrade tools that decide which NVM image should be uploaded to
the Thunderbolt controller need to access active parts of the NVM even
if they are not run as root. The information in active NVM is not
considered security critical so we can use the default permissions set
by the NVMem framework.
Writing the NVM image is still left as root only operation.
While there mark the active NVM as read-only in the filesystem.
Reported-by: Yehezkel Bernat <yehezkel.bernat@intel.com>
Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
Signed-off-by: Andreas Noever <andreas.noever@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
diff --git a/drivers/thunderbolt/switch.c b/drivers/thunderbolt/switch.c
index ab3e8f4..40219a7 100644
--- a/drivers/thunderbolt/switch.c
+++ b/drivers/thunderbolt/switch.c
@@ -281,9 +281,11 @@
if (active) {
config.name = "nvm_active";
config.reg_read = tb_switch_nvm_read;
+ config.read_only = true;
} else {
config.name = "nvm_non_active";
config.reg_write = tb_switch_nvm_write;
+ config.root_only = true;
}
config.id = id;
@@ -292,7 +294,6 @@
config.size = size;
config.dev = &sw->dev;
config.owner = THIS_MODULE;
- config.root_only = true;
config.priv = sw;
return nvmem_register(&config);