tree 9551483d5fd043ebee8c15e1e580d7587aa070ee
parent 38bd94b8a1bd46e6d3d9718c7ff582e4c8ccb440
author Matthew Garrett <mjg59@srcf.ucam.org> 1566260267 -0700
committer James Morris <jmorris@namei.org> 1566276855 -0700

PCI: Lock down BAR access when the kernel is locked down

Any hardware that can potentially generate DMA has to be locked down in
order to avoid it being possible for an attacker to modify kernel code,
allowing them to circumvent disabled module loading or module signing.
Default to paranoid - in future we can potentially relax this for
sufficiently IOMMU-isolated devices.

Signed-off-by: David Howells <dhowells@redhat.com>
Signed-off-by: Matthew Garrett <mjg59@google.com>
Acked-by: Bjorn Helgaas <bhelgaas@google.com>
Reviewed-by: Kees Cook <keescook@chromium.org>
cc: linux-pci@vger.kernel.org
Signed-off-by: James Morris <jmorris@namei.org>