diff options
| author | Alexander Usyskin <[email protected]> | 2016-01-17 10:25:01 +0000 |
|---|---|---|
| committer | Greg Kroah-Hartman <[email protected]> | 2016-02-07 06:12:56 +0000 |
| commit | 7326fffb712f09a315bc73cc1ee63843f59b8bd4 (patch) | |
| tree | 5f542b8e6172be47df34e28ab2b18c61064b4971 /drivers/misc/mei/main.c | |
| parent | Linux 4.5-rc1 (diff) | |
| download | kernel-7326fffb712f09a315bc73cc1ee63843f59b8bd4.tar.gz kernel-7326fffb712f09a315bc73cc1ee63843f59b8bd4.zip | |
mei: validate request value in client notify request ioctl
This patch address a possible security issue:
The request field in client notify request ioctl comes from user space
as u32 and is downcasted to u8 with out validation.
Check request field to have approved values
MEI_HBM_NOTIFICATION_STAR/STOP
Cc: <[email protected]> #4.3+
Signed-off-by: Alexander Usyskin <[email protected]>
Signed-off-by: Tomas Winkler <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
Diffstat (limited to 'drivers/misc/mei/main.c')
| -rw-r--r-- | drivers/misc/mei/main.c | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/drivers/misc/mei/main.c b/drivers/misc/mei/main.c index 677d0362f334..80f9afcb1382 100644 --- a/drivers/misc/mei/main.c +++ b/drivers/misc/mei/main.c @@ -458,7 +458,11 @@ static int mei_ioctl_client_notify_request(struct file *file, u32 request) { struct mei_cl *cl = file->private_data; - return mei_cl_notify_request(cl, file, request); + if (request != MEI_HBM_NOTIFICATION_START && + request != MEI_HBM_NOTIFICATION_STOP) + return -EINVAL; + + return mei_cl_notify_request(cl, file, (u8)request); } /** |