From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: From: Egor Ignatov To: devel-kernel@lists.altlinux.org Date: Wed, 6 May 2026 20:37:17 +0300 Message-ID: <20260506173722.1012394-2-egori@altlinux.org> X-Mailer: git-send-email 2.50.1 In-Reply-To: <20260506173722.1012394-1-egori@altlinux.org> References: <20260506173722.1012394-1-egori@altlinux.org> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Subject: [d-kernel] [PATCH 1/6] mtd: phram, slram: Disable when the kernel is locked down X-BeenThere: devel-kernel@lists.altlinux.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: ALT Linux kernel packages development List-Id: ALT Linux kernel packages development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 06 May 2026 17:37:33 -0000 Archived-At: List-Archive: List-Post: From: Ben Hutchings These drivers allow mapping arbitrary memory ranges as MTD devices. This should be disabled to preserve the kernel's integrity when it is locked down. * Add the HWPARAM flag to the module parameters * When slram is built-in, it uses __setup() to read kernel parameters, so add an explicit check security_locked_down() check Signed-off-by: Ben Hutchings Cc: Matthew Garrett Cc: David Howells Cc: Joern Engel Cc: linux-mtd@lists.infradead.org [egori: imported from Debian linux package, patch lockdown/mtd-disable-slram-and-phram-when-locked-down.patch] Signed-off-by: Egor Ignatov --- drivers/mtd/devices/phram.c | 6 +++++- drivers/mtd/devices/slram.c | 9 ++++++++- 2 files changed, 13 insertions(+), 2 deletions(-) diff --git a/drivers/mtd/devices/phram.c b/drivers/mtd/devices/phram.c index b42cadcd76..42ccabf24d 100644 --- a/drivers/mtd/devices/phram.c +++ b/drivers/mtd/devices/phram.c @@ -365,7 +365,11 @@ static int phram_param_call(const char *val, const struct kernel_param *kp) #endif } -module_param_call(phram, phram_param_call, NULL, NULL, 0200); +static const struct kernel_param_ops phram_param_ops = { + .set = phram_param_call +}; +__module_param_call(MODULE_PARAM_PREFIX, phram, &phram_param_ops, NULL, + 0200, -1, KERNEL_PARAM_FL_HWPARAM | hwparam_iomem); MODULE_PARM_DESC(phram, "Memory region to map. \"phram=,,[,]\""); #ifdef CONFIG_OF diff --git a/drivers/mtd/devices/slram.c b/drivers/mtd/devices/slram.c index 69cb63d99f..1330b47af0 100644 --- a/drivers/mtd/devices/slram.c +++ b/drivers/mtd/devices/slram.c @@ -43,6 +43,7 @@ #include #include #include +#include #include @@ -65,7 +66,7 @@ typedef struct slram_mtd_list { #ifdef MODULE static char *map[SLRAM_MAX_DEVICES_PARAMS]; -module_param_array(map, charp, NULL, 0); +module_param_hw_array(map, charp, iomem, NULL, 0); MODULE_PARM_DESC(map, "List of memory regions to map. \"map=, , \""); #else static char *map; @@ -281,11 +282,17 @@ static int __init init_slram(void) #ifndef MODULE char *devstart; char *devlength; + int ret; if (!map) { E("slram: not enough parameters.\n"); return(-EINVAL); } + + ret = security_locked_down(LOCKDOWN_MODULE_PARAMETERS); + if (ret) + return ret; + while (map) { devname = devstart = devlength = NULL; -- 2.50.1