shinys000114/linux
1
0
Fork 0
mirror of https://github.com/hardkernel/linux.git synced 2026-06-06 10:58:48 +09:00
Code Issues Packages Projects Releases Wiki Activity

mei: validate request value in client notify request ioctl

Browse Source 
commit 7326fffb71 upstream.

This patch address a possible security issue:

The request field in client notify request ioctl comes from user space
as u32 and is downcasted to u8 with out validation.
Check request field to have approved values
MEI_HBM_NOTIFICATION_STAR/STOP

Signed-off-by: Alexander Usyskin <alexander.usyskin@intel.com>
Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Alexander Usyskin
2016-01-17 12:25:01 +02:00
committed by Greg Kroah-Hartman
parent 6472e6b6af
commit a007fc3d65
1 changed files with 5 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
drivers/misc/mei/main.c
View File

@@ -458,7 +458,11 @@ static int mei_ioctl_client_notify_request(struct file *file, u32 request)
{
struct mei_cl *cl = file->private_data;
return mei_cl_notify_request(cl, file, request);
if (request != MEI_HBM_NOTIFICATION_START &&
request != MEI_HBM_NOTIFICATION_STOP)
return -EINVAL;
return mei_cl_notify_request(cl, file, (u8)request);
}
/**