diff options
| author | Raviv Shvili <rshvili@codeaurora.org> | 2014-12-06 20:06:27 +0200 |
|---|---|---|
| committer | Subhash Jadavani <subhashj@codeaurora.org> | 2016-05-31 15:25:54 -0700 |
| commit | 3f3e47cfbb93f0a1f1e996e7c1e932b9ef1eea8e (patch) | |
| tree | 56871e3d086923b37ed49aa303febe5226930764 /drivers/mmc | |
| parent | a35f5e1cc424d7b1bd2af0c1bd105413f8617002 (diff) | |
mmc: core : fix arbitrary read/write to user space
In the MMC card debug_fs the read and write handlers use the strlcat
and sscanf, without checking the pointer given.
Since the pointer is not checked it is possible to write
everywhere (ring 0 or 3).
In order to fix it, an access_ok function is being used to verify
the buffer's pointer supplied by user is valid.
CRs-fixed: 545716
Change-Id: Ia710b6af5a95974fc930ca902e8ff18afa4e17ba
Signed-off-by: Raviv Shvili <rshvili@codeaurora.org>
[merez@codeaurora.org: Fixed conflicts due to missing BKOPS statistics]
Signed-off-by: Maya Erez <merez@codeaurora.org>
Diffstat (limited to 'drivers/mmc')
| -rw-r--r-- | drivers/mmc/core/debugfs.c | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/drivers/mmc/core/debugfs.c b/drivers/mmc/core/debugfs.c index 734d2cce0a56..1479a96dfee4 100644 --- a/drivers/mmc/core/debugfs.c +++ b/drivers/mmc/core/debugfs.c @@ -15,6 +15,7 @@ #include <linux/slab.h> #include <linux/stat.h> #include <linux/fault-inject.h> +#include <linux/uaccess.h> #include <linux/mmc/card.h> #include <linux/mmc/host.h> @@ -424,6 +425,9 @@ static ssize_t mmc_wr_pack_stats_read(struct file *filp, char __user *ubuf, if (!card) return cnt; + if (!access_ok(VERIFY_WRITE, ubuf, cnt)) + return cnt; + if (!card->wr_pack_stats.print_in_read) return 0; @@ -564,6 +568,9 @@ static ssize_t mmc_wr_pack_stats_write(struct file *filp, if (!card) return cnt; + if (!access_ok(VERIFY_READ, ubuf, cnt)) + return cnt; + sscanf(ubuf, "%d", &value); if (value) { mmc_blk_init_packed_statistics(card); |