[PATCH] char: toshiba: restrict the SMM device to root

[PATCH] char: toshiba: restrict the SMM device to root

[Guo Zihao]

The toshiba misc device is registered without a .mode member:

static struct miscdevice tosh_device = {
	TOSH_MINOR_DEV,
	"toshiba",
	&tosh_fops
};

misc_devnode() only overrides the default when ->mode is non-zero, so
/dev/toshiba is created with the default 0666: every local user can
open it and issue TOSH_SMM ioctls.

tosh_ioctl() copies caller-supplied SMMRegisters into the CPU and
enters System Management Mode via inb $0xb2. The filter in front of
the call only rejects two HCI selectors (ax 0xff00/0xfe00 with
bx > 0x0069), so every other SMM entry point the BIOS offers, along
with caller-chosen register values, is reachable by unprivileged
userspace.

Give the misc device a mode of 0600 so the node is only usable by
root, which is what a ring -2 firmware interface should require.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Signed-off-by: Guo Zihao <guozh23@xiaopeng.com>
---
 drivers/char/toshiba.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/drivers/char/toshiba.c b/drivers/char/toshiba.c
index 776abbfd8..bea2643ec 100644
--- a/drivers/char/toshiba.c
+++ b/drivers/char/toshiba.c
@@ -87,9 +87,10 @@ static const struct file_operations tosh_fops = {
 };
 
 static struct miscdevice tosh_device = {
-	TOSH_MINOR_DEV,
-	"toshiba",
-	&tosh_fops
+	.minor	= TOSH_MINOR_DEV,
+	.name	= "toshiba",
+	.fops	= &tosh_fops,
+	.mode	= 0600,
 };
 
 /*
-- 
2.50.1